Trust

Security

Overview for brokers evaluating LoadVetter

LoadVetter is built as a multi-tenant freight risk application. Security is part of the product surface — not an afterthought — because assignment locks, overrides, and audit trails only matter if tenants and evidence stay isolated.

Controls in product

• TLS for all application traffic in production deployments.
• Passwordless magic-link authentication with database sessions (Auth.js).
• Broker-scoped data access: loads, carriers, rules, and finance rows are tenant-keyed.
• Role-based workspace permissions (owner, admin, ops, compliance, accounting, read-only).
• Rate limiting on public and sensitive endpoints.
• Immutable-style audit events for high-impact actions (overrides, exports, rate-con send).
• Secure random tokens for driver links, onboarding invites, and rate-con responses.
• Document storage via local or S3-compatible backends with broker/load-scoped keys.

Operational practices

• Automated unit and integration tests for auth, finance, and compliance gates.
• Backup / restore / upgrade scripts for self-hosted deployments.
• Dependency scanning recommended in CI (customer responsibility for on-prem).

Identity controls in product

• Password accounts with scrypt hashing and optional TOTP MFA (Settings → Security).
• Google / Microsoft SSO when enabled for the workspace.
• Magic-link email sign-in remains available for passwordless entry.

Roadmap (not yet claimed as done)

• Enterprise SAML/OIDC + SCIM provisioning.
• SOC 2 Type II report.
• Customer-managed encryption keys and regional data residency options.

Report a vulnerability

Email [email protected]. Please include steps to reproduce and avoid accessing other tenants' data.

Privacy · Terms · Disclaimer