Account-scoped data pooling.
Every admin belongs to an account. Admins sharing that account see each other's crew, projects, and rigs — admins outside it see nothing. There's no shared workspace to misconfigure and no permission matrix to maintain by hand as new users join.
| Resource | Subseaquence | North Basin OpCo |
|---|---|---|
| Crew roster | Visible | Hidden |
| Rig status | Visible | Hidden |
| Billing | Visible | Hidden |
A three-tier role model, not a single admin flag.
Command, admin, and crew each see exactly what their role requires — down to which actions are visible, not just which pages load. Scoping is enforced the same way whether the request comes from the app or the API.
| Tier | Crew data | Billing | Account settings |
|---|---|---|---|
| Command | Full | Full | Full |
| Admin | Full | View | None |
| Crew | Own record | None | None |
Deactivated, not deleted.
Removing a contractor's access blocks their login without erasing the crew, projects, or documents they created. Your operational record stays intact and attributable, even after the person who built it has moved on.
A full audit trail, ready before you need it.
Every booking, assignment, and document change is traceable to who did it and when. When a compliance review or an internal question comes up, the trail already exists — it doesn't need to be reconstructed from memory.
| Event | By | When |
|---|---|---|
| Booking confirmed | L. Haugen | 09:41 |
| Cert uploaded | S. Adeyemi | 08:55 |
| Rig status updated | D. Okafor | 08:02 |
Principles the platform is built on.
Encrypted in transit
All traffic between the app, API, and browser runs over TLS. There is no unencrypted path into the system.
Scoped at the API, not just the UI
Account and role scoping is enforced server-side on every request — the interface never becomes the only thing standing between an admin and another account's data.
Passwords never stored in plain text
Credentials are hashed, never logged, and never visible to platform staff in the course of normal operation.
Change reviewed with every deactivation
Removing access is a deliberate, logged action tied to an admin — never a silent toggle that's hard to trace back later.
Happy to go deeper with whoever needs to sign off.
We'll walk your security or compliance lead through the account model directly, on your timeline.