This page answers the questions carriers, brokers, shippers and insurers usually ask before they use TruckTA. Every answer describes what TruckTA does today. To keep a copy for your vendor file, use your browser's Print command and save it as a PDF.
If your review needs something that isn't here, or you have a questionnaire to fill in, email security@truckta.com and we'll answer it.
Company
- TruckTA LLC makes TruckTA, a transportation management system for trucking companies, with a web app and a Driver App for iPhone and Android.
- Security contact: security@truckta.com. Privacy contact: privacy@truckta.com.
Hosting and data location
- TruckTA's database runs on Supabase in Ohio and its servers run on Vercel in Cleveland, both in the United States.
- Supabase and Vercel are independently audited (SOC 2 Type 2) and encrypt stored data with AES-256. Those audits cover our providers, not TruckTA itself.
- Some optional services, such as AI features, maps and messaging, are run by providers listed on our Subprocessors page and may process data elsewhere.
Encryption
- In transit: TruckTA uses encrypted HTTPS connections. Plain web addresses redirect to HTTPS, and browsers are told to connect only over HTTPS for the next two years.
- At rest: stored data is encrypted by our hosting providers with AES-256.
- Field-level: driver and owner-operator Social Security and tax ID numbers, driver bank details, fuel card numbers from imported fuel statements and connected-app sign-in tokens are also encrypted with AES-256-GCM before they're saved.
- The Drivers list shows only the last four digits of an SSN or tax ID.
Sign-in and access control
- Every office user at your company (Owner, Admin, Manager, Dispatcher and Accountant) must pass two-step sign-in before opening the office workspace. The second step is a code from an authenticator app, or a one-time code by email.
- You can choose to have a computer remembered for 30 days. Leave it unchecked on a shared computer.
- People sign in with email and password or with Google.
- The Owner always has every permission. The Owner, and anyone the company allows to edit roles, decides what every other role can see and do in Roles & Permissions.
- The server checks who you are, your company and your role on every request, and database rules keep every company's records separate.
- Choosing Sign out in the TruckTA workspace signs that account out everywhere.
Documents and activity
- Documents are private files. Opening one creates a link that expires within minutes.
- The Activity Log on driver and equipment records shows who changed them, for people allowed to see it.
Payments
- Subscription payments use Stripe's hosted checkout. The card you pay with goes to Stripe, a PCI Level 1 payment provider, and never reaches TruckTA's servers or database.
- Fuel card numbers that come in with imported fuel statements are stored encrypted (see Encryption).
Browser protections
- Other websites can't show TruckTA's pages inside their own.
- Browsers are told not to guess file types, which stops some file-upload tricks.
- When you follow a link from TruckTA to another site, browsers send only TruckTA's address, not the page you were on.
- In browsers that support it, TruckTA's pages switch off browser features they don't need, including payment, USB and Bluetooth device access.
How changes reach production
- Code changes are delivered and tested on a separate staging system before they reach production.
- Production database migrations run only through a tool that requires a completed backup from the last 36 hours.
Vulnerability management
- Updates to the software packages TruckTA depends on are proposed every week.
- Every night, an automated job checks those packages for known vulnerabilities and scans TruckTA's code for passwords or keys committed by mistake.
- Anyone can report a security problem under our disclosure policy. We publish a security.txt file so researchers can find it.
Incident response
- TruckTA keeps a written incident response plan: contain the problem first, find which companies and records were affected, then tell each affected company's Owner what happened and what to do.
Your data, retention and deletion
- Your company keeps the rights to what it puts in TruckTA. We don't sell personal information, and we never delete company data for billing reasons.
- Export loads, drivers and more to CSV or Excel.
- On a driver's own phone, location sharing starts only after the driver sees a disclosure and allows it. On company-managed devices the company turns it on, and the device shows that location is being collected.
- Driver location history is deleted after about 30 days.
- Accounts can be deleted from the Driver App or the account deletion form on our website. Deletion has a short safety hold you can cancel, and some records may be kept where the law requires or where they belong to the company.
What we don't have yet
We'd rather tell you than have you find out. Today TruckTA has no SOC 2 report of its own, no third-party penetration test, no company single sign-on through your own identity provider (SAML), and no public status page. TruckTA is not PCI certified; card payments are handled by Stripe. We'll update this page when that changes.
Related
Security at TruckTAReport a security issueSubprocessorsPrivacy Policy