SECURITY

YOUR FLEET'S DATA IS YOURS ALONE

Every fleet on HaulOS is a separate tenant. Isolation is enforced by the database itself, not just the application: every table carries row-level security policies that scope reads and writes to the requesting user's organization. A request from one fleet cannot return, modify, or delete another fleet's loads, drivers, brokers, invoices, documents, or messages — even if the application layer were bypassed entirely.

Membership in an organization is set once at signup and can only change through a signed, expiring invitation accepted by the invited user's verified email. It cannot be altered from the client.

ENCRYPTION

All data is encrypted in transit with TLS and at rest with AES-256 on our database and storage provider. Uploaded documents — bills of lading, proof of delivery, compliance paperwork — are stored in private buckets that require an authenticated, organization-scoped request to read.

AUTHENTICATION & ACCESS

Passwords are hashed with bcrypt and never stored or logged in plain text. Sessions use short-lived, signed tokens. Password resets go through a time-limited link to the account's verified email.

Within a fleet, access is role-based: owners, admins, and dispatchers. Only owners and admins can invite or remove team members; only the owner can change billing or provision a dedicated messaging number.

PAYMENTS

HaulOS never sees, stores, or transmits a card number or bank account number. Subscription billing and broker invoice payments run entirely through Stripe, a PCI DSS Level 1 service provider. Invoice payments settle directly to your own connected Stripe account — HaulOS does not hold or route your freight revenue.

TEXT MESSAGING

SMS to drivers and brokers uses double opt-in: the recipient must reply YES from their own phone before any other message is sent, and consent can only be recorded by that reply — not by anyone in the dashboard. Every recipient can opt out at any time by replying STOP. The full flow is documented at haulos.app/sms-consent. Phone numbers are shared only with our SMS carrier to deliver messages you've authorized, and never for marketing.

AI PROCESSING

HaulOS uses Anthropic's Claude models to read rate confirmations, bills of lading, and compliance documents, score loads, and draft replies to text messages. Data sent to Anthropic's API is not used to train their models. Every AI action is logged in your AI Activity feed with its confidence score, and anything the AI is unsure about — or anything involving money — is presented to you as a draft rather than acted on.

INFRASTRUCTURE & SUBPROCESSORS

HaulOS is built on infrastructure providers that each maintain independent third-party security audits. We do not operate our own servers.

HaulOS itself does not currently hold a SOC 2 report. We will pursue one when a customer's procurement process requires it; in the meantime, the isolation, encryption, and access controls above are in place today and can be verified on request.

YOUR DATA, YOUR CALL

You can export your fleet's data or request its deletion at any time by contacting support. Deleting an account removes the organization and every record under it. We retain nothing after that beyond what payment regulations require Stripe to keep on their side.

REPORTING A VULNERABILITY

If you believe you've found a security issue in HaulOS, email support@haulos.app with "Security" in the subject line. We read every report and will respond within two business days. Please give us a reasonable window to fix an issue before disclosing it publicly.

QUESTIONS

Security questionnaire, vendor review, or anything not covered here: support@haulos.app · +1 (219) 210-8262. See also our Privacy Policy and Terms of Service.