Maritime's Privacy Policy, last updated May 17, 2026, says the service collects account data, agent configurations, deployment metadata and logs, encrypted API keys/secrets, usage metrics and ordinary web telemetry.7 It names Stripe, Railway, AWS, Hetzner and Neon as service providers, describes TLS in transit and AES-256-GCM for sensitive credentials at rest, and states that agent deployment data and logs are retained for the life of the agent plus 30 days after deletion.7
The environment-variable documentation says secrets are encrypted at rest, injected only into the relevant agent VM and masked in the UI; secret values are blanked when packaging an agent as a reusable template.8 The Terms state that customers retain ownership of deployed code, data, configurations and content, granting Maritime only the limited license needed to host, store and transmit that content to provide the service.9
Those disclosures provide useful transparency but do not amount to an independent security audit. The Terms also expressly avoid guaranteeing uninterrupted, secure or error-free service.9 The fixed independent panel produced no qualifying exact-product evidence, which is treated neutrally under Rating v1.0. Y Combinator independently corroborates the active Fall 2026 company and the managed-agent-cloud positioning, but is not a performance or security benchmark.10