Security

How we handle your data.

The short version: rate cons, driver PII, fuel-card transactions, and settlement math all live in a Postgres database on AWS RDS, encrypted at rest, reachable only through the CloudTMS application layer over TLS. No shared logins, no plaintext PII in email, no data sold or shared with third parties for advertising. If you’re building a security questionnaire and need something specific that isn’t here, email us at security@cloudtms.io and we’ll answer in plain English.

Encryption

At rest: All application data lives in a Postgres database on AWS RDS with storage-level encryption (AES-256) enabled. Backups and snapshots inherit the same encryption. Uploaded documents (rate cons, BOLs, PODs, medical cards) live in AWS S3 with server-side encryption (SSE-S3, AES-256).

In transit: Every request between your browser and CloudTMS is TLS 1.2+. HTTP is redirected to HTTPS at the edge. The mobile driver app pins the CloudTMS certificate authority.

Backups and recovery

Daily automated snapshots of the Postgres database are retained for 7 days. Point- in-time recovery is available up to 5 minutes in the past. Snapshots are encrypted and stored in a different AWS availability zone than the live database.

Access controls

Application access is per-user with role-based permissions (dispatcher, driver, accountant, super-admin — twelve roles in v1). Passwords are hashed with bcrypt. Two-factor authentication is available for every account and can be required for elevated roles.

Infrastructure access (RDS console, S3 bucket, deploy pipeline) is limited to CloudTMS employees who need it, secured with MFA, and audited.

Multi-tenant isolation

Every carrier’s data is scoped to a Company ID. Every query in the application code filters on the authenticated user’s Company ID before returning data. Cross-tenant data leakage is not possible via the application layer. We treat this as non-negotiable: security policy, code review policy, and test policy all enforce Company-ID scoping.

Incident response

If we discover a security incident that affects your data, we’ll notify you within 72 hours with what happened, what data was affected, and what we’re doing about it. To report a suspected vulnerability, email security@cloudtms.io — we acknowledge reports within one business day.

Sub-processors

The third-party services CloudTMS uses to run the platform are documented in our Privacy Policy (AWS for hosting and storage, Stripe for billing, Resend for transactional email, Pusher for real-time updates, Sentry for error reporting, plus integration partners like QuickBooks Online, Samsara, Motive, and the fuel-card providers). Each sub-processor has its own SOC 2 / GDPR posture linked from the Privacy Policy.

Data export and deletion

Every plan includes full data export. If you cancel, your data stays available for export for 30 days after your final billing cycle, then is deleted from the primary database. Encrypted backups holding a copy of your data age out over the following 90 days. To request an immediate delete, email privacy@cloudtms.io.

What we don’t have (yet)
SOC 2 attestation, ISO 27001 certification, and HIPAA BAA are not in scope for v1. If your compliance program requires any of these before you can use CloudTMS, email us at security@cloudtms.io — we’ll be honest about our roadmap.