Trust & assurance
Marinas hand us owner details, vessel particulars, insurance certificates and payment records. That information is protected by layered controls across the whole platform — the website, the BerthPoint dockmaster app and the marina office console.
Every table in our platform runs deny-by-default access rules. An outsider holding our public web key retrieves nothing — no enquiries, no bookings, no owner contact details, no insurance records, no quotes. Access is granted only to a signed-in account whose role explicitly allows it.
Managers, dockmasters, WHS officers and security each see only what their duties require. Licensees reach their own arm and amenities; only dockmasters and managers hold override access. Roles are stored separately from user profiles and validated on the server for every request, so they cannot be forged from a browser.
Certificates of currency, contractor SWMS, fault photos, marina plans and quote PDFs are held in private buckets with no public URLs. Uploads are validated and written server-side; downloads are issued as short-lived signed links to authorised staff only.
When a boat owner uploads insurance from their own phone at the dock, the link is single-use, time-limited and reveals nothing but the berth it was issued for. Expired or unrecognised links return no data.
Admin and staff sign-ins, dock walks, gate key changes, berth movements and safety checks are written to an immutable audit trail that staff cannot edit or delete. Management can see who did what, where and when.
Enquiry, berth request and document upload forms are rate limited per connection, size and file-type checked, and protected against cross-site request forgery. Payment events are accepted only when the provider's cryptographic signature verifies.
All traffic is forced over TLS with strict transport security, content-type sniffing, cross-origin framing and referrer leakage are blocked at the edge, and data at rest is encrypted on Australian-hosted infrastructure with automated backups and point-in-time recovery.
Payment keys, messaging credentials and privileged database keys exist only in the server environment. They are never bundled into the website, never logged, and are rotatable without downtime.
Found something that looks wrong? Report it to sean@sydneymarinelogistics.com.au and we will respond within one business day. We do not pursue researchers who report issues in good faith.
