Security at Marine-CRM
Version: 1.6
Last updated: 25 August 2026
Our approach
CIRCLESEA OÜ has designed a risk-based security programme for the intended Marine-CRM production Website and B2B service. The controls described here must be verified through the launch gates before customer activation and then maintained for the operated functions. This page provides a high-level public summary. Detailed configurations, thresholds, access routes, and incident procedures remain confidential because publishing them could weaken security.
No system can be guaranteed completely secure. This page does not create an uptime, recovery, incident-response, or remediation guarantee and does not claim a certification that CIRCLESEA OÜ has not obtained.
Infrastructure and location
The intended production architecture uses Hetzner infrastructure in Germany for production hosting, the primary database, and encrypted backups. Zone.ee in Estonia provides domain, DNS, and corporate-email services. The exact implemented provider list and locations must pass the launch verification gate before customer activation. A new production provider or processing location is subject to privacy, security, contractual, and international-transfer review before relevant data is disclosed.
Control areas
Our security programme covers:
- individual accounts, role-based access, least privilege, and controlled account recovery;
- multi-factor authentication and revocable sessions for functionality that requires authenticated access;
- secure transport and protected storage appropriate to the data and system;
- separation of customer organisations and server-side authorisation checks;
- restricted administrative and support access;
- protected credentials and secrets;
- security, access, misuse, and incident logging without intentionally recording passwords or authentication secrets;
- backup, restoration, retention, and deletion controls;
- change review, dependency review, vulnerability management, and testing; and
- incident response, legal escalation, and customer or authority notification where required.
A control-dependent feature may not be represented as operational merely because it appears in a policy. The relevant implementation and test must be completed before that feature processes production data.
Before a material feature or provider change affecting security, privacy, support, or AI use is enabled, CIRCLESEA OÜ reviews the change and updates the relevant public documents where necessary.
Customer responsibilities
Customers must use named accounts, protect passwords and authentication factors, maintain current authorised-user access, use supported devices, configure permissions appropriately, and promptly report suspected compromise. Account sharing, scraping, automated extraction, limit circumvention, malicious activity, and unauthorised security testing are prohibited.
Independent review and certifications
CIRCLESEA OÜ requires an independent security assessment before production customer access and periodically afterward in accordance with its internal risk programme. Findings are prioritised and tracked to closure.
CIRCLESEA OÜ does not currently claim ISO 27001, SOC 2, or another security certification. References to recognised practices describe an approach, not certification.
Reporting a vulnerability
Please follow our Responsible Vulnerability Disclosure Policy and email security@marine-crm.com. Do not send passwords, active tokens, private keys, or unredacted personal/customer data by ordinary email.
Privacy questions: privacy@marine-crm.com
Legal notices: legal@marine-crm.com
Company
CIRCLESEA OÜ
Registry code: 17563486
VAT number: EE103012063
Address: Võistluse tn 23-44, Kesklinna linnaosa, 10132 Tallinn, Harju maakond, Estonia