PHAROSSigning in
- Every Pharos screen sits behind Cloudflare Access. Your users sign in with a one-time email code or Google.
- Pharos decides which company a user belongs to from a cryptographically verified sign-in token, never from anything the browser could fake.
- A signed-in user who belongs to no company sees an empty account, never someone else's fleet.
- Administrator rights come from a short named list, not from a setting stored with the data.
Keeping companies apart
- Each company's data is stored under its own separate key space, applied in one place in the code rather than by each feature.
- Public information — security incidents, sanctions lists, navigational warnings — is shared by everyone. Your fleet, your briefs and your settings are not.
- Responses that carry a company's data are marked private, so no shared cache can hand them to anyone else.
Encryption
- Every connection is encrypted (HTTPS), and browsers are told never to connect any other way.
- Your company's data is stored in the EU — our database runs in Frankfurt, Germany — and is encrypted at rest there. The one exception is email: our provider Resend keeps the emails it delivers, including your daily reports, in the US for 30 days. The app itself runs on Cloudflare's network, close to whoever is using it.
- Any third-party account keys you give us (for example a tracking-service API key) are additionally encrypted by Pharos itself (AES-256-GCM) before they are stored.
In your browser
- Every Pharos page sends a content security policy. Scripts must come from Pharos itself or a short list of named services, and every script written into a page must carry a key issued for that one page view; an injected script without it is refused.
- Pharos cannot be framed by another website, and the browser features it does not need — camera, microphone, location, payment — are switched off.
Machines that send us data
- Position reports and feeds arrive on a separate address that only accepts requests carrying a key. Each company has its own key, so one can be replaced without touching anyone else.
- Keys are compared in constant time and never printed by our own tooling.
What we keep, and for how long
- Most data expires on its own: a ship's brief after 30 days, its brief history after 21, a record of when each user was last active after 90.
- Your account settings, user list and alert subscriptions stay until you or we delete them. A deletion request is carried out by us, with a dry run first that lists everything it will remove.
- Pharos holds no crew or personnel data, runs no advertising or third-party trackers, and never combines one company's data into another's view.
Who sees your vessel data
Daily briefs are written by AI language models. To write a ship's brief, the model receives that ship's name, IMO number, type, flag and position, and the risk context around it — and nothing else: the data is cut down to a fixed list of fields before it is sent.
- Cloudflare Workers AIThe first choice — runs inside the same network that already serves Pharos.
- AnthropicUsed only if Workers AI is unavailable.
Neither trains its models on your data.
- Other providers that run the service: Cloudflare (hosting, sign-in, email routing), Upstash (database and job queue), Resend (email delivery), Telegram (our own operations alerts) and the browser makers' push services for phone alerts.
- Map tiles come to your browser straight from the map providers — OpenFreeMap for the map and, when you switch it on, Esri for the satellite view. They see your browser's address and the area you are viewing, never your ships.
- Ship-tracking providers receive your ships' identifiers (MMSI or IMO number), and nothing about your company: the licensed providers of shore and satellite AIS that find your ships' positions.
What we do not have yet
No independent penetration test.
Our security reviews so far have been internal.
No SOC 2 or ISO 27001 certification.
Deletion is not self-service.
You ask, we carry it out.
Last updated .