Security & Privacy
How SeaValid protects seafarer documents
Seafarer certificates are sensitive personal documents. This page explains, in plain language, who can reach them, for how long, and what is recorded.
The seafarer owns the documents
Your certificate records belong to you. Nobody else can read them through the app. If you create a private share link, you decide what it shows and can revoke it at any time.
Private storage, owner-based access
Files are held in a private storage bucket with no public URLs. Access is decided by database-level policies tied to the signed-in owner, and the platform applies encryption in transit and at rest. If no policy grants your account access, the request is refused — there is no general-access path.
No searchable database of seafarers
SeaValid V1 has no recruiter search, no agency accounts and no employer directory. Your profile is never listed or discoverable — the only way to show it to someone is a private link you generate yourself.
Download links expire in 5 minutes
Files are never public. Viewing a document creates a private link that stops working after five minutes, and a new link is only issued if access is still valid at that moment. Revoking access takes effect immediately.
Activity is logged and retained
Uploads, views, downloads and share-link changes are recorded. Through the app you can read your own log but not edit or delete entries; changes and removals are only possible through our backend, for example when you delete your account or under our retention schedule.
Uploads are checked on our servers
Every uploaded file is re-checked on our servers to confirm its real contents match an accepted PDF or image format. Files that do not match are quarantined and removed.
Who can see what
- You: full access to your own certificate records, files, share links and activity log.
- Anyone holding your share link: only the summary fields you chose to include, until you revoke the link. Files are never included by default.
- Nobody else: there is no general-access route to seafarer documents through the app.
Where your data is stored, and for how long
- Storage location: our primary database and your uploaded files are stored in the European Union, in AWS eu-west-3 (Paris). Email delivery and website serving use providers that may process data outside the EU, so we do not claim EU-only processing.
- Encryption: encryption in transit and at rest is applied at platform level by our hosting and storage providers. SeaValid does not add its own application-level encryption on top of that.
- Your certificate data: kept while your account is open, and deleted when you delete your account.
- Logs: the activity log is retained for 24 months; email delivery and expiry-reminder logs are retained for 12 months. After that they are permanently deleted by a daily scheduled clean-up that only touches records past their period — never active accounts, certificate records, files or current exports.
- Data exports: deleted 7 days after you request them.
- Do-not-email list: if you unsubscribe or mail to you repeatedly fails, we keep your email address and the reason for as long as needed to honour that, and remove it on request where appropriate.
Your controls
- Export: Settings → Your data → “Request my data export” produces a JSON copy of your profile, certificates, reminder settings, share-link details, file list and activity log. Download links are private to you and the export is deleted after 7 days.
- Deletion: Settings → “Delete my account” removes your profile, certificate records, uploaded files, share links, activity log and sign-in. We retain a minimal record — a one-way hash of your email address, a completion flag, timestamps and technical counts — for 24 months for security, fraud prevention, abuse prevention and legal accountability, then delete it.
- Full policy: see our Privacy Policy.
- Questions: SeaValid controller contact — rihards.jansons@seavalid.com.
What we do not claim
SeaValid validates the file format of every upload on the server, but antivirus and malware scanning are not active yet. Each document carries a security state so scanning can be added without changing who may access what. We also make no certification or regulatory-compliance claims on this page.
Questions about your data? Email rihards.jansons@seavalid.com — the SeaValid controller contact.