The short version: rate cons, driver PII, fuel-card transactions, and settlement math live in a Postgres database on AWS RDS, and uploaded documents live in AWS S3. We do not sell your data. This page states our policy and the controls behind it, and it says plainly what we do not have. If you’re building a security questionnaire and need something specific that isn’t here, email us at security@cloudtms.io and we’ll answer in plain English.
At rest: The Postgres database on AWS RDS uses storage-level encryption (AES-256). Uploaded documents (rate cons, BOLs, PODs, medical cards) are stored in AWS S3 with server-side encryption (SSE-S3, AES-256) applied on upload. Integration credentials for ELD and similar vendors are encrypted before they are stored.
In transit: The application is served over HTTPS, and browsers are told to refuse plain HTTP through a one-year HSTS header.
Automated daily snapshots of the Postgres database are retained for 7 days, with point-in-time recovery inside that window.
Application access is per-user with role-based permissions (twelve roles, including dispatcher, driver, accounting, billing, and company admin). Passwords are hashed with bcrypt. Two-factor authentication is available for every account, and a company admin can require it for admin roles.
Access to the production infrastructure is limited to CloudTMS staff who need it.
Policy: every carrier’s data is scoped to a Company ID, and every query that returns carrier data must filter on the authenticated user’s Company ID.
Controls: the scoping is applied in the application’s data-access code, and code review checks every change against that rule. We do not claim that mistakes are impossible; if you find a cross-tenant exposure, report it to the address below.
If we confirm a security incident that affects your data, we will notify the affected carriers directly, with what happened, what data was involved, and what we are doing about it. To report a suspected vulnerability, email security@cloudtms.io — we aim to acknowledge reports within one business day.
The third-party services CloudTMS uses to run the platform are listed in our Privacy Policy: AWS, Stripe, Resend, Pusher, Upstash, Sentry, Anthropic, Google Maps Platform, Cloudflare Turnstile, and Expo, plus the integration partners a carrier chooses to connect, such as QuickBooks Online, Samsara, Motive, and Geotab.
Every plan includes CSV export per module (loads, fuel, tolls, IFTA, compliance, billing, reports). To request deletion of your data, email privacy@cloudtms.io. Retention periods are set out in the Privacy Policy.