Security

Only things that are true today and were checked in the software. Where something is not in place, this page says so. It makes no claim of any audit, certification or standard.

What is in place

• Company separation. Every company's records are protected by row-level security in the database: a person sees only their own company's data, and a driver sees their own information. This has been tested with scripted checks in a scratch database. It has not been tested by an independent penetration test.
• Second step. The database refuses company data to administrator, dispatcher and office-staff sessions that have not passed the authenticator-app (TOTP) check. Exception: while a temporary setting is on, drivers can sign in with email and password only (they still see only their own information). [OWNER: state the current setting here, or turn the exception off.]
• Sensitive fields. Social Security and alien-registration numbers are encrypted in the database; most people see the last four digits; every reveal is logged. The encryption key is stored in the same database (not in a separate key service). QuickBooks tokens, ELD provider keys and people's own AI keys are stored encrypted. The payment connection token is protected by access rules only and is not yet encrypted separately.
• Payment cards. Card numbers are entered into the payment provider's own fields; Carrier Nexus receives a token, not the number.
• Files. Document storage buckets are private. Uploads from outside parties pass through checked server functions (type, size and content checks).
• Records. An audit trail records who did what, with network address and browser. Electronic signatures, consents and location history are append-only. Signatures store a fingerprint of the signed text.
• Limits. Daily caps on AI use, e-mail sending and map lookups per company; the public links (officer, inspector, repair) are rate-limited.
• Page protection. Our pages refuse to be shown inside other websites; the public officer page sends no referrer and loads nothing from other websites.
• Software changes. Changes pass automatic checks (code parse, site audit, tests) before they are published.

What is not claimed

• No SOC 2, ISO 27001 or other certification or audit report.
• No independent penetration test, bug-bounty programme or 24-hour security monitoring.
• Backup and disaster-recovery arrangements beyond what the database provider includes in our plan have not been tested or documented. [OWNER: confirm plan and restore test.]
• No automatic deletion of personal data (see the Privacy Notice).
• The browser holds a copy of some records for speed (see storage notice): protect your device.

What you can do

• Use a unique password and the authenticator step; sign out on shared devices; remove people who leave; tell us at once if you suspect a problem.

Reporting a security problem

[OWNER: security contact e-mail. Until set, use the Provide Feedback button and mark it High.] Please give us a reasonable time to fix a problem before you tell others, and do not access other people's data. [COUNSEL: safe-harbour wording.]

If there is a breach

We will notify as the law requires (see the Privacy Notice). There is no automated incident register yet.