Trust & Security
Last updated 14 October 2026
Operators hand Gentoo their crew’s passports, medical certificates, contracts and conduct reports. This page says plainly where that data lives, who touches it, how long we keep it, and what we do not offer yet. Ask us for anything that is not here.
Where your data lives
Each operator has its own workspace. Every record carries the workspace it belongs to, and every read and write your people make is scoped to it on the server. Gentoo staff reach workspaces through an internal console, used for setup, support and deletion on request, and our engineers have backend admin tools for fixes. Trial sandboxes are isolated the same way, one per person.
Crew records, schedules, contracts, reports and rest-hour logs are stored in our database provider’s cloud in the United States. Uploaded crew files (certificate scans, receipts, signed contracts) are stored in object storage and served through signed links that expire after five minutes, never public URLs. The phone apps keep a copy for use offline. PDFs added to your library sit in our database provider’s file storage behind long, unguessable links that do not expire.
All traffic is encrypted in transit with TLS. Data is encrypted at rest by our infrastructure providers.
Who processes it
These are the providers that touch operator data on our behalf. We will tell you by email before adding one.
| Provider | What it does | What it sees |
|---|---|---|
| Vercel | Hosts the web app | Requests to the dashboard |
| Convex | Database and backend | All workspace records and library PDFs |
| Clerk | Sign-in and sessions | Names, emails, sign-in events, and each person’s workspace and role |
| Cloudflare R2 | File storage | Uploaded documents and photos, and generated compliance reports |
| Resend | Transactional email | Recipient address and the notification text |
| Apple, Google | Push notifications, and genuine-app checks on receipt photos | Device tokens, the notification text, and device integrity tokens (not the receipt) |
| Anthropic | Writes AI answers and reads documents: Polaris, briefing drafts, certificate and receipt reading, and pasted-list import | The question and a fixed snapshot of records for the asker’s role: for crew, the last six turns, their own profile, documents, contract, travel, tasks and voyage schedule, and teammates’ names and roles; for the office, ships and voyages active or starting within two weeks, a roster summary (names, nationality, experience, document status) and library passages. Certificate and receipt files sent for reading. The voyage name and itinerary for briefing drafts. Text pasted into Smart import |
| Voyage AI | Search index for Polaris. A second AI provider: it turns text into search vectors and does not write answers | Library text (guidelines, your manuals and procedures, approved briefings) and the text of each Polaris question |
| komoot (Photon) | Place search on maps and briefing drafts | The place names and map points being looked up, and the viewer’s IP address for searches made in the browser |
| OpenFreeMap, AWS open data, jsDelivr, currency-api.pages.dev | Map tiles, terrain, exchange rates and the PDF reader | The viewer’s IP address and the map area on screen; for exchange rates, only currency codes, requested from our servers |
An AI call happens only when someone acts: asks Polaris a question, uploads a document or scans a receipt, imports a list, adds or edits a library document, or drafts a briefing. No AI call runs on a timer; the only recurring job is a daily certificate-expiry reminder by push and email. Briefing drafts can search the web through Anthropic’s search tool, using places from the itinerary. We do not use crew data to train models.
Who can see what
- ·Each person holds one role in the workspace: crew, travel desk, HR or owner.
- ·HR and owners see the workspace and manage settings and office invites. Inside your workspace, only an owner can make someone else an owner; Gentoo staff can also issue an owner invite or set a role from the backend, for setup or when a link is lost.
- ·Contract and assignment changes made on the server are written to an audit log with who, what and when. Office edits in the dashboard are logged by the browser as they save, and edits from the phone apps are not logged yet. Nobody can edit an entry; ask us for an extract.
- ·Filed reports cannot be edited in the product. Triage changes their status, assignee, thread and linked tour, never the original text.
Conduct reports and the EU Whistleblower Directive
Concerns is a reporting channel, not a compliance certificate. Directive (EU) 2019/1937 puts the obligations on the operator: a confidential channel, acknowledgement within seven days, feedback within three months, and protection from retaliation. Gentoo gives you timestamped reports and replies to evidence acknowledgement and feedback.
- ·Speak Up concerns and exit surveys can be filed anonymously. An anonymous report and its thread carry no name or account: the reporter, who files while signed in, receives a one-time case code and uses it to follow the thread.
- ·Each report records when it was filed, and the thread keeps every reply in order with its time, so your first answer is on the record.
- ·Reports cannot be rewritten after they are filed, through the app or through Gentoo’s staff console. Gentoo’s backend tools can delete a report along with its thread.
How long we keep it
Workspace data is kept for the term of your contract. When it ends, we delete the workspace on request and confirm in writing; provider backups roll off on their own schedule after that.
Expenses and payout batches export as CSV from the dashboard, rest hours as a monthly CSV per person, and each voyage’s compliance report as a PDF. We provide a full workspace export on request, and we will help you leave if you ask.
Ask us and we will delete a trial sandbox.
Agreements
- ·A data processing agreement is available on request, with the current list of providers annexed.
- ·If we confirm a breach affecting your data, we tell you without undue delay and no later than 72 hours after confirming it, with what we know and what we are doing.
What we do not offer today
We would rather you hear this from us than find out in procurement.
- ·No SOC 2 report yet. A Type I audit is planned; ask us for the current timeline.
- ·No single sign-on or SCIM provisioning. People sign in through Clerk with Google or email, and with Apple on iPhone.
- ·No EU-only data residency. Data is stored in the United States.
- ·No payroll. Gentoo does not run payroll or calculate wages; contracts hold the agreed pay terms, and expense payout batches export as CSV for your payroll provider.
Contact
Security questions, a suspected vulnerability, or a data request: hello@getgentoo.com. We reply within two working days.
This document is a plain-language summary provided for convenience and is not legal advice. For questions, email hello@getgentoo.com.