Security & Data Protection

1. Our Approach

HighwayTMS is built so that security is structural rather than cosmetic: tenant boundaries and permissions are enforced in the database and on the server, not just hidden in the interface. This page describes the safeguards that exist today. It is not a certification page, and it is not a promise that security incidents can never happen.

2. Safeguards in Place

Authentication & sessions

• Authentication is handled by Supabase Auth with email/password and optional Google sign-in.
• Users must accept the Terms of Service and Privacy Policy before using the application, and acceptance is recorded with a version and timestamp.
• Supabase Auth uses browser-accessible session cookies so the browser and server can maintain and refresh the session.
• Password recovery uses explicit, expiring one-time confirmation links.

Tenant isolation & authorization

• Every company’s records are scoped to a company identifier.
• PostgreSQL Row Level Security (RLS) enforces tenant boundaries at the database, so direct data requests are still subject to per-company policies.
• Role-based authorization separates Tenant Admins from Employees: rate confirmations, settlement and financial data, and driver credential documents are Admin-only; Employees are limited to operational workflows such as loads and BOL/POD documents.
• The platform Sysadmin role operates the Service (companies, users, system health) but does not, by itself, grant access to tenant documents or financial data.

Documents

• Documents (BOLs, PODs, rate confirmations, CDL and medical-card files) are stored in private Supabase Storage.
• Access requires an authenticated, authorized session — there are no public, transferable file-sharing links.
• Uploads are validated for type and size, and documents move through a managed lifecycle rather than casual deletion.

Application & infrastructure

• The production site is served over HTTPS, with strict transport-security, content-security-policy, and related protective headers.
• Privileged credentials (such as database service keys) are kept server-side and are never shipped to the browser.
• Subscription payments are handled on Stripe-hosted pages; card numbers never reach or are stored by HighwayTMS.
• [CONFIRM BEFORE LAUNCH: database backup schedule and retention, per the production backup runbook, before stating them here.]
• Production secrets are managed through environment configuration on the hosting platform, not committed to source control.

3. Customer Responsibilities

Security is shared. The controls above work best when each customer does its part:

• Protect user credentials. Use strong, unique passwords and never share accounts between people.
• Assign appropriate roles. Give Employee access to people who only need operational workflows; reserve Admin for those who need financial and credential data.
• Review authorized users regularly and remove access promptly when someone changes roles or leaves.
• Confirm data accuracy. The Service stores and calculates from what you enter — verify records, documents, and settlement figures before relying on them.
• Meet your record-retention obligations. Determine the retention rules that apply to your business and manage your records accordingly.
• Keep endpoint devices secure. Use updated browsers, lock screens, and protect the devices your team uses to sign in.

4. Honest Limits

We want to be precise rather than reassuring. Unless we tell you otherwise in writing:

• we do not claim third-party security certifications (such as SOC 2 or ISO 27001);
• we do not claim continuous penetration testing or a 24/7 security operations center;
• no safeguard guarantees that a breach can never occur; and
• the Service does not verify the authenticity or legal sufficiency of documents you upload.

If your compliance program requires specific assurances, contact us at support@highwaytms.com before relying on the Service for that purpose.

5. Report a Security Issue

To report a vulnerability, follow our Responsible Disclosure Policy, which sets out scope, safe harbor, and what to expect. Reports go to support@highwaytms.com; the same contact is published at /.well-known/security.txt.

For how data is handled more broadly, see the Privacy Policy.