MARPOL Annex I · Regulation 17

The Oil Record Book, signed at the moment of the operation

Entries are chained with SHA-256 & attested with ECDSA P-256 on the vessel, offline. The shore sees them when the link comes back, not before.

See an inspection Read the conformance note

Built to IMO Resolution MEPC.312(74), adopted 17 May 2019 and in force 1 October 2020.

Oil Record Book, Part I ✓ Chain verified
C 12.3 Disposal of oil residues 2.40
D 13.2 Non-automatic discharge of bilge water 11.40
C 11.2 Collection of oil residues 0.85
head 0451 offline, queued 62

Specimen entries. Quantities in m³.

Built against MEPC.312(74) MARPOL Annex I Reg.17 IACS UR E26 / E27 FIPS 140-3, CMVP #5247

The four components and where each one runs

Shipboard operations set the constraints: weeks without a link, hardware that has to survive an engine room, & an inspector who needs the book open in front of them in minutes.

Ship-side service Go

The authoritative book on the vessel. SQLite under SQLCipher for local storage, NATS JetStream for the outbound queue to shore.

Shore-side API FastAPI

Multi-tenant fleet backend. Ingests synced entries, rejects any whose signature or hash chain fails to verify, & holds the cross-fleet record.

Shore dashboard React 18

Fleet overview, alerts, reports, & audit views for superintendents. REST for reads, WebSocket for the live compliance state.

REST API OpenAPI 3.1

Documented against OpenAPI 3.1, so an existing fleet management, VDR, or ERP system can read the same record the dashboard reads.

Designed against the type approval requirements published by the classification societies, including DNV Type Approval Programme No. 1-433.20. DNV Lloyd’s Register Bureau Veritas ClassNK ABS
Offline-first

A vessel can be dark for weeks. The book cannot.

Every feature runs without a link. The ship-side service is the authority on the vessel; shore is a mirror that catches up, not a dependency the officer waits on.

  • Entry, signing, & export work with the satellite link down
  • NATS JetStream replays the queue on reconnect, in order
  • USB export for a port state control officer with no network
  • Closed books render to PDF/A-2b on the vessel, no shore round trip
See how sync works
Link state: offline, 9 days
queued 62
signed 62
synced 0

Entries hold at the leaf node. Nothing is lost & nothing is blocked.

Tamper evidence

Each entry carries the hash of the one before it

Tamper evidence is structural, not a setting. There is no debug path & no admin path that writes an entry outside the chain.

  • SHA-256 hash chain across every entry in the book
  • ECDSA P-256 officer attestation at the moment of signing
  • Append-only: an amendment is a new record, never an overwrite
  • FIPS 140-3 validated module, CMVP certificate #5247
Read the conformance note
Chain of custody
0449c9d0e1f2…7a41✓
0450e5f6a7b8…1d02✓
0451a1b2c3d4…9e88✓

head 0451 · 451 entries verified

Shore visibility

Fleet state without waiting for a vessel to report it

Superintendents read the same signed records the vessel holds. An entry that fails verification at ingest is rejected, logged, & raised as an alert; it never reaches the authoritative store.

  • Per-operator isolation enforced by row-level security in Postgres
  • Overdue & missing-entry alerts per vessel, not per fleet
  • PDF/A archival export for inspections & class audits
  • Role separation for crew, officers, superintendents, & auditors
See the dashboard
Fleet overview
12Verified
1Pending sync
0Overdue
MV Pacific StarChain verified
MT Coral BayChain verified
MV Northern SpiritOffline, 9 d

Specimen fleet.

See the book the way an inspector sees it

A walkthrough runs the full sequence: an entry made offline, signed on the vessel, synced on reconnect, & opened cold by a port state control officer.

Book a walkthrough See pricing