Trust & Security

How we protect your data, source our intelligence, and operate the platform.

Strait Up Maritime is a sanctions screening and compliance monitoring platform. Compliance teams use our output to inform decisions with legal and financial consequences. This page documents our security practices, data sources, update cadences, known limitations, and corporate structure so you can evaluate us as a vendor and design your compliance program around our specific capabilities.

Regulatory status

Corporate structure and data transfer framework

Entity	Role	Jurisdiction
Prime Calibre Pty Ltd	Customer-facing reseller, billing, support — your contracting party and data processor	Australia (ABN 76 678 167 407)
Prime Calibre Limited	Platform owner, IP principal, technology and data operations — sub-processor	Hong Kong

Your subscription contract is with Prime Calibre Pty Ltd (Australia). The platform, its intellectual property, and underlying technology are owned and operated by Prime Calibre Limited (Hong Kong). Prime Calibre Pty Ltd is an authorised reseller of Prime Calibre Limited under a distribution agreement that includes a trademark licence for the Strait Up Maritime brand.

Hong Kong data transfer framework

Customer personal data is hosted in Singapore (not Hong Kong). Prime Calibre Limited (Hong Kong) operates the platform as a sub-processor under our Data Processing Agreement and may access personal data as necessary for platform operation, support, and development. Transfers of personal data from the UK/EEA to Hong Kong are covered by the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914, Module Two or Three as applicable) and, for UK transfers, the UK International Data Transfer Addendum. A Transfer Impact Assessment is available on request.

Government data access

We have received no government data access requests to date from any jurisdiction. We will challenge requests we believe to be unlawful and will notify affected customers where legally permitted to do so. Our policy is to minimise the personal data we hold and to resist disclosure of customer screening activity to any third party.

Data sources and update cadence

We aggregate data from public sanctions lists and third-party maritime data providers. We do not originate sanctions data — we consolidate, cross-reference, and present it. The accuracy and timeliness of our output depends on the accuracy and timeliness of these upstream sources.

Source	Data type	Update frequency
OFAC SDN List	US sanctions designations	Daily
EU Consolidated List	EU sanctions designations	Daily
UN Security Council	UN sanctions designations	Daily
UK OFSI	UK sanctions designations	Daily
Australia DFAT	Australian sanctions designations	Daily
Japan MoF	Japanese sanctions designations	Daily
Switzerland SECO	Swiss sanctions designations	Daily
AIS feeds	Vessel positions (terrestrial + satellite)	Continuously, typically every 20–40 minutes per vessel
Vessel registries	Ownership, flag, classification, DWT	Enriched on first detection, refreshed periodically
IMF PortWatch	Historical chokepoint baselines (2019–2026)	Monthly

Detection latency

There is an inherent delay between the moment a sanctions authority publishes a new designation and the moment it appears in our system. Our sanctions lists are polled daily. In practice, designations published during business hours by OFAC or the EU typically appear in our system within 24 hours. We do not currently guarantee a specific detection-to-alert latency — if latency SLAs are important to your compliance program, contact us to discuss your requirements.

Every screening result includes a timestamp showing when the screening was performed and which lists were checked.

Scope and known limitations

What we screen

• Vessels, identified by IMO number (primary), MMSI (secondary), and vessel name
• Name matching includes recorded variations, aliases, and historical names where available in public registries
• Ownership and management matching extends to entities explicitly named in sanctions designations and to registered owners/managers in public vessel registries
• Flag-state risk assessment based on jurisdiction
• Behavioural indicators: AIS dark periods (periods during which a vessel's AIS transponder was not transmitting), ship-to-ship transfer patterns, floating storage, visits to high-risk zones

What we do not screen

• Individual persons, crew members, or passengers
• Beneficial ownership chains beyond what appears in public vessel registries — for full beneficial-ownership diligence, additional tools or specialist services are recommended
• Cargo contents or trade documentation
• National sanctions lists beyond the 7 listed above

Other limitations

• AIS coverage has gaps, particularly in remote ocean regions and near-polar areas. Vessels can intentionally disable AIS transponders — we flag extended gaps as a risk indicator, but AIS absence alone is not proof of sanctions evasion
• Vessel identity (IMO, MMSI, name, flag) can change over time; we track known identifiers but cannot guarantee complete history for all vessels globally
• Ship-to-ship transfer detection is based on AIS proximity patterns and may produce false positives in congested anchorages or port areas
• Dark fleet assessments in the Dark Fleet Report involve analyst judgment based on observable indicators, not definitive intelligence (see Intelligence Products below)

Infrastructure and data residency

All customer data is hosted in Singapore (Railway's Asia-Southeast region). The website is served globally via Cloudflare's edge network. We do not currently offer data residency in other regions.

Security controls

Control	Implementation
Encryption in transit	TLS 1.2+ on all connections. HSTS enforced.
Encryption at rest	Uploaded documents in encrypted object storage (Railway Buckets). Database hosted on Railway's managed PostgreSQL with provider-level disk encryption.
Authentication	Passwordless (magic link + OTP via email). Cryptographically generated session tokens. No passwords stored.
Injection prevention	Parameterised database queries throughout. No raw SQL interpolation.
Security headers	HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy on all responses
Rate limiting	Per-IP and per-account rate limits on screening and authentication endpoints
Tenant isolation	All queries scoped by customer_id; application-level tenant isolation enforced across all data access paths
Session management	Sessions expire after inactivity. Logout invalidates server-side session record.
API surface	We do not currently offer API access. All interaction is via authenticated dashboard sessions, reducing attack surface.

Personnel security

All personnel with access to production systems or customer data are under confidentiality agreements. Production access is limited to essential personnel and is revoked on departure. Customer screening activity is treated as commercially sensitive and is not disclosed to any third party.

Vulnerability management

Dependencies are monitored for known vulnerabilities. Security patches for critical CVEs are applied promptly. For responsible disclosure of security issues, contact [email protected].

Data handling

What we store

• Account data: name, email, company name
• Usage logs: which vessels you screen, when, and the result — retained 12 months from creation for audit and abuse prevention, regardless of account status, then deleted
• Watchlist: vessel identifiers you choose to monitor
• Notes and documents: content you attach to vessel records (Starter plan and above) — deleted within 30 days of account termination
• Session data: tokens and IP addresses for authentication — retained for session duration plus 30 days

What we don't store

• Passwords (we use passwordless authentication)
• Credit card numbers (Stripe handles all payment data)
• Third-party tracking cookies or advertising identifiers

Data portability and export

Customers on Starter and Professional plans can export their watchlist and audit trail as CSV from the dashboard. Account data and screening history can be provided on request by emailing [email protected]. You can delete your account and all associated data at any time via the dashboard settings page.

Compliance and legal

Business continuity

Database backups are managed by Railway per their infrastructure SLA. The application is stateless and can be redeployed from source. Formal disaster recovery procedures with measured RTO/RPO targets are on our roadmap.

Screening methodology

When you screen a vessel, we:

1. Match the vessel identifier (IMO, MMSI, or name — including recorded aliases and historical names) against our consolidated database of 7 international sanctions lists
2. Check for ownership, management, and flag-state risk indicators from public vessel registries
3. Assess behavioural indicators: AIS dark periods, ship-to-ship transfer patterns, floating storage, flag changes, visits to high-risk zones
4. Present each indicator individually with its source and basis, alongside a composite risk score

Screening result states

Every screening result returns one of three states:

• "No matches found on screened lists" — the vessel does not currently appear on any of the 7 sanctions lists we screen, at the time of the query. This is not a guarantee of compliance status. Sanctions designations change without notice.
• "Sanctions list match found" — the vessel appears on one or more screened sanctions lists, with the specific list(s) and designation details shown.
• Risk indicators present — the vessel is not sanctions-listed but exhibits behavioural or registry indicators (dark periods, STS patterns, high-risk flag, etc.) that your compliance team should evaluate.

Risk score

We present a composite risk score (0–100) alongside individual risk factors and their weighting. The score is a summary of observable indicators — it is not a compliance determination. Each factor (sanctions match, flag risk, dark periods, STS transfers, flag changes, floating storage) is weighted and shown individually so your compliance team can assess the basis for the score and apply their own judgment. The scoring model is documented internally and available for review on request.

Intelligence products

Dark Fleet Report

Our weekly (or daily, on Professional plans) Dark Fleet Report is an intelligence summary of sanctioned vessel activity based on public data, AIS behaviour analysis, and analyst judgment. Named-vessel assessments in the report describe observed patterns and public designations — they are not conclusions about illegal activity. Language in the report reflects what has been observed ("vessel has been observed operating with AIS disabled for X days") rather than what has been concluded ("vessel is engaged in sanctions evasion").

Corrections and clarifications can be requested by emailing [email protected].

Vendor questionnaire

We provide completed security questionnaires on request. For standard or custom questionnaires, contact [email protected] with your questionnaire and we will return it promptly.

Documents

• Terms of Service — scope of service, customer obligations, liability limitations, indemnification
• Privacy Policy — data collection, sharing, residency, retention, and data subject rights
• Data Processing Agreement — GDPR-compliant DPA with sub-processor list, SCCs, breach notification, and retention schedule

Roadmap

• Annual third-party penetration testing
• Formal disaster recovery procedures with measured RTO/RPO
• Increased sanctions list polling frequency

Last updated: 22 April 2026. Questions: [email protected]