Evidence-grade. By architecture.
Full Fathom runs offline, onboard. No external API calls during inference. No crew PII in query logs. Every bundle is verified end-to-end. Every answer carries its source.
Honest about posture. Transparent about roadmap.
The architecture is evidence-grade where it needs to be — every answer cites the source, every bundle is verified, no crew PII leaves the vessel. Formal certifications sit on the roadmap; we'll say exactly where each one is rather than imply anything we can't back.
Six controls. Non-negotiable.
No external calls during inference
The shipboard runtime executes every stage of the pipeline locally. There is no cloud API call during a query, no outbound network required, no telemetry shipped per answer. The only shore-side communication is bundle delivery — one-way, verified, batched.
Query logs are anonymous
Crew queries never leave the vessel except as anonymous question-answer pairs for fleet-level gap analysis. We strip all crew identifiers before any upload. Fleet analytics show frequency and topic coverage, never individual identities.
SHA-256, end-to-end
Every bundle is checksummed at build, transferred with its checksum, and re-verified before apply. Verification failure rejects the update and keeps the previous working bundle running. Automatic rollback on any post-apply failure. No partial update state exists.
Retrieved content is data, not instructions
A malicious PDF cannot hijack the model with embedded prompts. Citation validation and the sufficient-context autorater catch content-based injection attempts before the crew sees anything. Grammar-constrained output and strict context boundaries narrow the attack surface by design.
Each fleet is sealed
Shore-side, every company's documents, embeddings, and bundles live in strictly isolated tenants. No shared models, no training on customer data, no cross-tenant retrieval path. Deletion is permanent and propagates to every index.
Every answer is evidence
Every query is logged on the vessel. Every answer cites the source document, section, and page. Confidence is derived from four observable signals and explained in the UI. The SMS being actively used is demonstrable in inspection or incident review.
Every query leaves a trace you can inspect.
The onboard ledger records the question asked, the chunks retrieved, the citations verified, the confidence derived, and the SHA-256 of the bundle that produced the answer. Port State Control does not have to take anything on trust.
- — PII-stripped before any shore-side aggregation.
- — Local SQLite ledger, exportable on demand.
- — Refusals logged with the reason they fired.
Shore and ship are fully independent.
Two deployable units. Bundle transfer is the only link between them. No two-way data path, no live query channel, no outbound connection from the vessel.
Web dashboard
Authenticated fleet-manager access
Document processor
Parse, chunk, embed
Bundle builder
Package versioned artifact
Fleet analytics
Anonymous query intelligence
Tenant isolation
Per-company hard boundary
Local language model
Executes on vessel hardware
Vector + keyword index
Full bundle searchable offline
Citation validator
Rejects ungrounded claims
Refusal system
Length-aware, never guesses
Bundle verifier
SHA-256 + automatic rollback
Where the data lives, what we answer in.
Inference and query logs stay onboard. Shore-side document processing and bundle generation run out of the EU (Ireland) today. UK and US regions are available on request and will ship as design partners require them. Only anonymous aggregate query data flows shore-side, and only when the operator has opted in.
English today, for both queries and document ingestion. Additional crew languages (Filipino, Ukrainian, Mandarin) are on the roadmap, driven by design-partner requirements. Tell us which language matters for your fleet and we'll say straight where it sits.
No formal SLA yet. Honest about what we deliver.
Pre-launch, we operate as a founder-led engineering team out of Propel Group's London office. A signed SLA will land alongside the first commercial deployment; until then, these are the commitments we make explicitly.
One business day for any pilot or security enquiry, measured against UK business hours.
Onboard runtime outage is treated as severity 1. Shore-side bundle delivery is severity 2. Roadmap and cosmetic are severity 3.
A founder is on the first call for every severity 1. We don't hide behind a queue.
— Evidence over assertion —