The short version: rate cons, driver PII, fuel-card transactions, and settlement math all live in a Postgres database on AWS RDS, encrypted at rest, reachable only through the CloudTMS application layer over TLS. No shared logins, no plaintext PII in email, no data sold or shared with third parties for advertising. If you’re building a security questionnaire and need something specific that isn’t here, email us at security@cloudtms.io and we’ll answer in plain English.
At rest: All application data lives in a Postgres database on AWS RDS with storage-level encryption (AES-256) enabled. Backups and snapshots inherit the same encryption. Uploaded documents (rate cons, BOLs, PODs, medical cards) live in AWS S3 with server-side encryption (SSE-S3, AES-256).
In transit: Every request between your browser and CloudTMS is TLS 1.2+. HTTP is redirected to HTTPS at the edge. The mobile driver app pins the CloudTMS certificate authority.
Daily automated snapshots of the Postgres database are retained for 7 days. Point- in-time recovery is available up to 5 minutes in the past. Snapshots are encrypted and stored in a different AWS availability zone than the live database.
Application access is per-user with role-based permissions (dispatcher, driver, accountant, super-admin — twelve roles in v1). Passwords are hashed with bcrypt. Two-factor authentication is available for every account and can be required for elevated roles.
Infrastructure access (RDS console, S3 bucket, deploy pipeline) is limited to CloudTMS employees who need it, secured with MFA, and audited.
Every carrier’s data is scoped to a Company ID. Every query in the application code filters on the authenticated user’s Company ID before returning data. Cross-tenant data leakage is not possible via the application layer. We treat this as non-negotiable: security policy, code review policy, and test policy all enforce Company-ID scoping.
If we discover a security incident that affects your data, we’ll notify you within 72 hours with what happened, what data was affected, and what we’re doing about it. To report a suspected vulnerability, email security@cloudtms.io — we acknowledge reports within one business day.
The third-party services CloudTMS uses to run the platform are documented in our Privacy Policy (AWS for hosting and storage, Stripe for billing, Resend for transactional email, Pusher for real-time updates, Sentry for error reporting, plus integration partners like QuickBooks Online, Samsara, Motive, and the fuel-card providers). Each sub-processor has its own SOC 2 / GDPR posture linked from the Privacy Policy.
Every plan includes full data export. If you cancel, your data stays available for export for 30 days after your final billing cycle, then is deleted from the primary database. Encrypted backups holding a copy of your data age out over the following 90 days. To request an immediate delete, email privacy@cloudtms.io.