Security & Data Trust
Enterprise-grade security. SOC 2 certified. GDPR-compliant. AES-256 encryption, multi-layer access controls, and 99.95% uptime SLA protecting millions of daily operator transactions.
Data Security & Infrastructure
Encryption & Data Protection
• At-rest encryption: AES-256 (AWS KMS managed keys)
• In-transit encryption: TLS 1.2+ for all API and web traffic
• End-to-end: Sensitive operator data (SSN, bank account, license) encrypted client-side before transmission
• Database encryption: All RDS instances encrypted; key rotation quarterly
• Backup encryption: All backups encrypted and replicated across geographic zones
Infrastructure & Monitoring
• Hosting: Amazon Web Services (US regions: us-east-1, us-west-2)
• Network isolation: VPC with public/private subnet architecture
• DDoS protection: AWS Shield Standard + CloudFlare WAF
• Intrusion detection: Automated alerts for unauthorized access attempts
• Real-time monitoring: 24/7 SOC alerts, CloudWatch + PagerDuty integration
• Incident response: Documented playbooks, <15 min time-to-response
Disaster Recovery & Uptime
• RTO (Recovery Time Objective): <4 hours
• RPO (Recovery Point Objective): <1 hour
• Redundancy: Multi-AZ deployment, database replication
• Uptime SLA: 99.95% (monitored by third-party uptime monitoring)
• Backup frequency: Hourly snapshots, 30-day retention, tested monthly
• At-rest encryption: AES-256 (AWS KMS managed keys)
• In-transit encryption: TLS 1.2+ for all API and web traffic
• End-to-end: Sensitive operator data (SSN, bank account, license) encrypted client-side before transmission
• Database encryption: All RDS instances encrypted; key rotation quarterly
• Backup encryption: All backups encrypted and replicated across geographic zones
Infrastructure & Monitoring
• Hosting: Amazon Web Services (US regions: us-east-1, us-west-2)
• Network isolation: VPC with public/private subnet architecture
• DDoS protection: AWS Shield Standard + CloudFlare WAF
• Intrusion detection: Automated alerts for unauthorized access attempts
• Real-time monitoring: 24/7 SOC alerts, CloudWatch + PagerDuty integration
• Incident response: Documented playbooks, <15 min time-to-response
Disaster Recovery & Uptime
• RTO (Recovery Time Objective): <4 hours
• RPO (Recovery Point Objective): <1 hour
• Redundancy: Multi-AZ deployment, database replication
• Uptime SLA: 99.95% (monitored by third-party uptime monitoring)
• Backup frequency: Hourly snapshots, 30-day retention, tested monthly
Access Controls & Identity Management
Identity & Access Management (IAM)
• SSO integration: Okta for employee authentication (SAML 2.0)
• MFA enforcement: Required for all admin and operator accounts
• Password policy: 12+ characters, complexity requirements, 90-day rotation for production access
• Session management: Auto-logout after 30 mins of inactivity
Role-Based Access Control (RBAC)
• Operator roles: Admin (full access), Dispatcher (dispatch-only), Finance (settlement only)
• Employee roles: Engineer, Product, Finance, Customer Support, Operations
• Principle of least privilege: Default deny; explicit allow for each role
• Access review: Quarterly attestation of access levels; quarterly recertification
Audit & Logging
• Activity logging: All data access, modifications, deletions logged with timestamp & user ID
• Log retention: 90 days in hot storage, 7 years in archive
• Operator data isolation: Database row-level security; operators can only view/modify their own data
• Automated alerts: Suspicious access patterns, mass exports, privilege escalation attempts
Vendor & Third-Party Access
• Vendor risk assessment: Security questionnaire, SOC 2 certification review
• Production access: Limited to engineers on-call; change control process required
• Contractor NDAs: All third-party developers, contractors sign IP & confidentiality agreements
• SSO integration: Okta for employee authentication (SAML 2.0)
• MFA enforcement: Required for all admin and operator accounts
• Password policy: 12+ characters, complexity requirements, 90-day rotation for production access
• Session management: Auto-logout after 30 mins of inactivity
Role-Based Access Control (RBAC)
• Operator roles: Admin (full access), Dispatcher (dispatch-only), Finance (settlement only)
• Employee roles: Engineer, Product, Finance, Customer Support, Operations
• Principle of least privilege: Default deny; explicit allow for each role
• Access review: Quarterly attestation of access levels; quarterly recertification
Audit & Logging
• Activity logging: All data access, modifications, deletions logged with timestamp & user ID
• Log retention: 90 days in hot storage, 7 years in archive
• Operator data isolation: Database row-level security; operators can only view/modify their own data
• Automated alerts: Suspicious access patterns, mass exports, privilege escalation attempts
Vendor & Third-Party Access
• Vendor risk assessment: Security questionnaire, SOC 2 certification review
• Production access: Limited to engineers on-call; change control process required
• Contractor NDAs: All third-party developers, contractors sign IP & confidentiality agreements
Compliance & Certifications
SOC 2 Certification
• Type I: Completed Dec 2024 (passed controls assessment for security, availability, confidentiality)
• Type II: In progress; completion target Q2 2025 (6-month audit period for control operating effectiveness)
• Scope: All platform infrastructure, access controls, change management
Privacy Compliance
• GDPR: Data processing agreements in place; EU data residency option available (AWS eu-central-1)
• CCPA: Privacy policy compliant; operator right-to-deletion, opt-out mechanisms implemented
• GDPR Data Protection: DPA with processors (AWS, Stripe, Okta); regular processor reviews
• Operator consent: Explicit opt-in for data collection; granular consent for analytics, research
Transportation Industry Regulations
• FMCSA compliance: Real-time HOS/ELD validation; no direct regulatory responsibility (operator bears liability)
• DOT integration: Automated safety incident scoring, compliance tracking
• Insurance regulation: Licensed insurance facilitator; partnerships with admitted carriers only
Regular Security Audits
• Penetration testing: Annual third-party pentest; remediation tracking
• Code security: Static analysis (SonarQube), dependency scanning (Snyk)
• Infrastructure security: AWS Well-Architected review annually
• Incident response drills: Quarterly tabletop exercises; documented playbooks tested
Business Continuity & Disaster Recovery
• BCP/DRP: Documented and tested annually
• Insurance: Cyber liability ($5M coverage), E&O insurance
• Crisis communication: Incident response team, stakeholder notification procedures
• Type I: Completed Dec 2024 (passed controls assessment for security, availability, confidentiality)
• Type II: In progress; completion target Q2 2025 (6-month audit period for control operating effectiveness)
• Scope: All platform infrastructure, access controls, change management
Privacy Compliance
• GDPR: Data processing agreements in place; EU data residency option available (AWS eu-central-1)
• CCPA: Privacy policy compliant; operator right-to-deletion, opt-out mechanisms implemented
• GDPR Data Protection: DPA with processors (AWS, Stripe, Okta); regular processor reviews
• Operator consent: Explicit opt-in for data collection; granular consent for analytics, research
Transportation Industry Regulations
• FMCSA compliance: Real-time HOS/ELD validation; no direct regulatory responsibility (operator bears liability)
• DOT integration: Automated safety incident scoring, compliance tracking
• Insurance regulation: Licensed insurance facilitator; partnerships with admitted carriers only
Regular Security Audits
• Penetration testing: Annual third-party pentest; remediation tracking
• Code security: Static analysis (SonarQube), dependency scanning (Snyk)
• Infrastructure security: AWS Well-Architected review annually
• Incident response drills: Quarterly tabletop exercises; documented playbooks tested
Business Continuity & Disaster Recovery
• BCP/DRP: Documented and tested annually
• Insurance: Cyber liability ($5M coverage), E&O insurance
• Crisis communication: Incident response team, stakeholder notification procedures
