Security

Freight brokers hand us operationally sensitive information: rates, driver contact details, customer relationships. Here's what we actually do to protect it, described plainly rather than left to a compliance badge.

Tenant isolation

Every organization's data is scoped to that organization. Which organization a request belongs to is resolved on our servers from your authenticated session, never from anything the browser sends, so one organization's loads, drivers, or documents aren't reachable from another's account.

Role- and permission-based access

Accounts are assigned a role (ops admin, dispatcher, ops manager, driver, or customer viewer), and specific capabilities, like seeing a driver's phone number or managing an ELD connection, are further gated by permission. Role and permission checks happen on the server for every request, not just in what the interface shows.

Encrypted credentials

API tokens for connected ELD/telematics accounts are encrypted at rest (AES-256-GCM) and are never displayed in plain text again after you save them.

Private document storage

Uploaded documents, including rate confirmations, bills of lading, and proof of delivery, are stored in private object storage. A document's stored reference isn't a public URL; every read goes through an authorized request that checks organization membership first.

Infrastructure

LoadSignal runs on Vercel, with data stored in Neon (Postgres) and authentication handled by Clerk. Webhook endpoints (for SMS, email, and ELD events) verify a cryptographic signature from the sending provider before processing anything, using constant-time comparison to avoid leaking timing information about the expected signature.

Where we are, honestly

LoadSignal is early-stage and has not completed a third-party security audit or certification such as SOC 2, ISO 27001, or a similar framework. We're not claiming one. If a certification is a requirement for your organization, tell us during early access. We want to know what standard to build toward, not present something we haven't earned.

Reporting a security issue

If you believe you've found a security vulnerability in LoadSignal, please report it to support@getloadsignal.com rather than filing a public issue. We'll acknowledge reports and work with you on disclosure timing.

For how we collect and use personal data, see our Privacy Policy.