MANTIS Security Overview

Version: 1.5 Date: 13 August 2026 Author: Navio Maritime OÜ

1. Infrastructure and Hosting

MANTIS is a cloud application with no self-managed customer servers.

• Frontend hosting: Cloudflare Pages
• Backend and database: Supabase, running on AWS eu-central-1 (Frankfurt, Germany)
• Authentication: Supabase Auth
• Backups: Encrypted database exports to Cloudflare R2 with an EU location preference
• Infrastructure providers: Cloudflare, Supabase, and AWS maintain security programmes and third-party certifications

2. Data Encryption

• At rest: Data is encrypted at the database and storage layer
• In transit: HTTPS/TLS is enforced for browser and API traffic
• Credentials: Passwords are hashed by Supabase Auth and never stored in plaintext
• Secrets: API keys are stored as deployment environment variables, not in source code

3. Authentication and Access Control

MANTIS uses Supabase Auth for:

• Email and password authentication
• Password reset flow
• Session management
• Optional TOTP multi-factor authentication
• Rate-limited authentication endpoints

Application access is controlled through organisation, vessel, and role membership. PostgreSQL policies resolve access per vessel, including direct vessel membership and shared vessel grants.

4. Data Isolation

MANTIS is multi-tenant. Customer access is isolated through PostgreSQL Row Level Security (RLS).

• RLS is enabled on customer data tables
• Policies scope access by organisation membership, vessel membership, and shared vessel grants
• Users only see vessels they are authorised to access
• Billing-owner vessel state is enforced at the data-access layer, not only in the user interface
• Service-role database access is confined to server-side functions

5. Application Security

• React output encoding protects normal UI rendering from XSS
• User input is validated before processing
• CORS is configured for the MANTIS application domain
• Production builds disable development tooling
• Application errors are monitored through Sentry

6. Backup and Recovery

• Daily encrypted database exports are written to Cloudflare R2. They cover database records, not uploaded Supabase Storage files
• R2 backup retention is 30 days
• Customers can export vessel records as XLSX files, survey-ready packages, and full account archives containing structured records and uploaded evidence documents
• After service termination, Customer Personal Data is held for export, return, or reactivation during a maximum 30-day transition window before deletion from production systems, unless earlier deletion is requested or limited records must be retained for legal reasons
• Customer archive exports provide portability for uploaded evidence; they are not an independent provider-side backup of uploaded Storage files
• Point-in-time recovery is not part of the standard plan

7. Compliance Posture

• GDPR: Primary database and uploaded-file storage in an EU region, DPA available, provider transfer safeguards, and data export/deletion support
• PCI DSS: Payment processing is handled by Stripe; MANTIS does not store card numbers
• Audit trail: Material changes, archive actions, billing lifecycle events, export requests, and security-relevant events are logged with user and timestamp
• Service providers: Roles, primary regions, and transfer safeguards are listed in the Service Provider Register

8. Incident Response

• Reporting: security@mantis-ihm.com
• Acknowledgement: within 2 business days
• Initial triage: within 5 business days
• Customer notification: without undue delay where customer data is affected

9. Contact

For security questions, vulnerability reports, or DPA requests:

Security: security@mantis-ihm.com
Privacy: privacy@mantis-ihm.com
Support: support@mantis-ihm.com
Web: mantis-ihm.com