Technical Security Architecture & Implementation · Version 1.0 · March 24, 2026
PortFlow is a maritime logistics SaaS platform built with security as a core architectural principle. This whitepaper details PortFlow's security measures, technical architecture, and compliance roadmap for maritime agencies evaluating data security and regulatory compliance.
JWT Token Structure:
{
"sub": "user_id_uuid",
"org_id": "organization_id_uuid",
"role": "operator|administrator|auditor|sales|gerente_general",
"iat": 1711270800, "exp": 1711357200
}
| Role | Vessels | Quotations | Invoices |
|---|---|---|---|
| Administrator | Full (R/W) | Full (R/W) | Full (R/W) |
| Gerente General | Read (R) | Read (R) | Read (R) |
| Operador | Full (R/W) | Read (R) | Read (R) |
| Ventas | Read (R) | Full (R/W) | Read (R) |
| Auditor | Read (R) | Read (R) | Read (R) |
Payment Information
Credit card data NOT stored in PortFlow. Processed by PCI-DSS certified provider. Only last 4 digits retained for reference.
PII Data
Crew names, passport numbers encrypted if stored. Minimum retention; deleted when no longer needed.
Auth Tokens
Stored in HttpOnly cookies only. Never logged or exposed in URLs.
Key Management
Keys stored in secure environment variables. Quarterly key rotation plan. Never committed to source code.
PortFlow is a multi-tenant platform. Each organization's data is strictly isolated across three enforcement levels:
Every user belongs to exactly one organization. Every API query filters by organization_id. Cross-organization access is impossible by design.
Row-Level Security policies enforce isolation. Queries automatically restricted to current organization's data. Even if application code has a bug, database prevents cross-tenant access.
-- Example RLS Policy
CREATE POLICY org_isolation ON vessels
USING (organization_id = current_user_org_id())
WITH CHECK (organization_id = current_user_org_id());
PortFlow engineers do not have default access to customer data. Production database access requires multi-factor authentication. All access is logged, audited, and reviewed quarterly.
Logged Events
Log Retention
Log Security
Database Hosting
Encryption in transit (TLS) and at rest (AES-256). Multi-region data centers. Automated backups with point-in-time recovery.
Vetting: Completed ✓ · DPA: Signed ✓
Application Hosting
DDoS protection. Web Application Firewall (WAF). Automatic certificate management. Global edge network.
Vetting: Completed ✓ · DPA: Signed ✓
Marina Chatbot
No training on customer data. User queries deleted within 30 days. API rate limiting and abuse prevention.
Vetting: Completed ✓ · DPA: Signed ✓
Support / CRM
Encryption in transit and at rest. Role-based access controls. Audit logging.
Vetting: Completed ✓ · DPA: Signed ✓
PortFlow implements the core technical controls recommended by the International Maritime Organization's MSC-FAL.1/Circ.3-Rev.3 Guidelines on Maritime Cyber Risk Management, enabling maritime agencies to demonstrate compliance with IMO cyber security recommendations.
MSC-FAL.1/Circ.3 Alignment
Maritime agencies using PortFlow can demonstrate to port authorities and regulators that they have implemented the cyber risk management controls recommended by the IMO, supporting compliance with international maritime security standards and operational cyber resilience requirements.
Security researchers and customers can report security issues to: security@portflow.tech
Please allow 90 days for us to address issues before public disclosure. We will acknowledge receipt within 24 hours and provide periodic updates. Security researchers who report critical issues will be publicly credited if desired.
PortFlow © 2026 · All Rights Reserved · Document Version 1.0 · This whitepaper is intended for technical and security evaluation purposes.