SSB Hub · Security overview

Controls built into how the platform works.

SSB Hub holds your customers, prices, limits and deals. This is the register of what protects them, and who looks after each control.

  • C-01

    Controlled sign-in

    Users are invited by your administrator. Sign-in supports authenticator-app multi-factor authentication, and errors never reveal whether an account exists.

    Managed byWorkspace administrator

  • C-02

    Roles and screen rights

    Each user has a role and a rights group. Rights are set per screen: read, write, approve, post, print and export.

    Managed byWorkspace administrator

  • C-03

    Limits and approvals

    Customer credit limits, trader limits and company exposure thresholds hold a deal for approval before it can proceed.

    Managed byManagement

  • C-04

    Audit trail

    Changes are recorded with who, when, and the old and new values. The record cannot be edited or deleted from the application.

    Managed byAdministrators, read-only

  • C-05

    Separate workspaces

    Each customer works in its own workspace, and every request is scoped to it.

    Managed bySSB Hub

  • C-06

    Encryption

    Traffic between your browser and SSB Hub is encrypted in transit over HTTPS. Stored data is encrypted at rest by the infrastructure providers (AES-256).

    Managed bySSB Hub

  • C-07

    Protected documents

    Attachments are stored privately and opened through short-lived links, with file type checks on upload.

    Managed bySSB Hub

  • C-08

    Sanctions screening

    Customers and vessels are screened against sanctions and watch lists. A failed check blocks confirmation until an exception is approved.

    Managed byCompliance officer

Certified infrastructure

Built on platforms that are independently audited.

SSB Hub runs on infrastructure providers that hold the certifications below, as published on their own security pages. These are the providers’ certifications, not claims that SSB Hub itself is certified.

Database, authentication and file storage

Supabase

  • SOC 2 Type 2
  • ISO 27001
  • HIPAA (under a BAA)
  • GDPR-supporting deployments, with DPA
  • Customer data encrypted at rest with AES-256 and in transit with TLS
  • Daily database backups on paid plans
  • Regular penetration testing and code scanning
  • DDoS and abuse protection, rate limiting and brute-force defence
  • Multi-factor authentication available for accounts
Source: supabase.com/security

Application hosting and delivery

Vercel

  • SOC 2 Type 2
  • ISO 27001
  • PCI DSS (SAQ-D service provider)
  • GDPR, with DPA
  • EU-U.S. Data Privacy Framework
  • TISAX Assessment Level 2
  • Data encrypted at rest with AES-256 and in transit with HTTPS/TLS
  • Automatic DDoS mitigation and a platform firewall
  • Third-party penetration testing, static analysis and dependency scanning
  • Backups taken every two hours and kept for 30 days
Source: vercel.com/security

Network edge and DDoS protection

Cloudflare

  • SOC 2 Type II
  • ISO 27001:2022
  • ISO 27018
  • ISO 27701
  • PCI DSS Level 1 (service provider)
  • GDPR
  • DDoS mitigation and web application firewall at the network edge
  • Traffic encrypted in transit between visitors and the edge
  • Independently audited security, privacy and availability controls
Source: cloudflare.com/trust-hub

See SSB Hub in your workflow

See it with your own ports, grades and barges.

We walk through SSB Hub using your products, customers and workflow.