Security

Our approach

We use security controls that are designed to protect your data, and we describe them accurately. No online service can be guaranteed to be completely secure, and we do not claim to be. This page reflects the controls we actually have in place; where we rely on a third-party provider for a control, we say so.

Infrastructure Security

DumpTruckBoss runs on Supabase (built on Amazon Web Services). We do not operate our own physical servers. Our deployment uses:

• Managed PostgreSQL database hosting
• Network controls and DDoS mitigation provided at the platform/edge layer
• Separation of production data from application code

Our infrastructure providers (Supabase and AWS) maintain their own independent, third-party security certifications — such as SOC 2 — for the platforms and facilities they operate. DumpTruckBoss itself is not currently SOC 2, ISO 27001, PCI, or HIPAA certified, and we do not represent that it is.

Data Encryption

Data is protected in transit and at rest:

• In transit: TLS 1.2 or higher for connections to the application. HTTP requests are redirected to HTTPS.
• At rest: AES-256 encryption applied by our infrastructure provider to stored data, including database contents and file uploads.
• Passwords: Handled by our authentication provider (Supabase Auth) using industry-standard one-way hashing. We never store plaintext passwords and cannot retrieve them.
• Third-party accounting tokens: QuickBooks Online OAuth tokens are additionally encrypted (AES-256-GCM) before being stored.
• Payment cards: Card details are handled entirely by Stripe. We never receive or store full card numbers on our servers.

Access Controls and Isolation

DumpTruckBoss is multi-tenant. Data isolation is enforced by a combination of server-side authorization checks in our application and PostgreSQL Row Level Security (RLS):

• Requests are authenticated and scoped to the requesting company's records
• These controls are designed to prevent one company from accessing another company's data
• Role-based permissions within a company (for example: owner/admin, dispatcher, driver, accountant, foreman)
• Drivers access their own work and tickets, not the full company dashboard

DumpTruckBoss personnel do not access customer data in the ordinary course of business. When a member of our team accesses a customer account for support or troubleshooting, that access is restricted and recorded in an internal audit log.

Authentication

• Optional TOTP-based two-factor authentication (e.g., Google Authenticator, Authy)
• Sessions expire after periods of inactivity
• Email verification for new accounts and email changes
• Rate limiting on sensitive endpoints (such as ticket submission and login for driver accounts) to slow automated abuse

Backups and Recovery

• Automated daily backups of core business data
• Our database provider also maintains platform-level backups of the underlying database

Backups exist to help recover from data-loss events. Because backups are retained for a period after data is created or deleted, information you delete may persist in backups for a limited time before it ages out.

Monitoring and Incident Response

We monitor the application and respond to issues:

• Application error and performance monitoring via Sentry, with alerting
• Internal audit logging of sensitive actions (such as support/administrative account access and ticket changes)

If we confirm a security incident affecting your data, we will investigate, contain, and remediate it, and notify affected customers and any regulators or authorities where and when required by applicable law or our contract with you, without undue delay. We do not commit to a single universal notification deadline for every situation.

Customer Responsibilities

Security is shared. You are responsible for keeping your login credentials confidential, enabling two-factor authentication, managing who on your team has access, and using GPS, location, driver, and personal information you put into DumpTruckBoss in compliance with the laws that apply to you — including providing any notices and obtaining any consents required before tracking drivers, employees, contractors, or vehicles.

Responsible Disclosure

We take security reports seriously. If you discover a vulnerability in DumpTruckBoss, please report it to us privately before disclosing it publicly. We aim to:

• Acknowledge your report within a few business days
• Investigate and work toward remediation
• Let you know when the issue is resolved
• Credit you publicly (if you'd like) for the finding

We do not currently operate a paid bug-bounty program.

Questions

For security questions, vendor assessments, or privacy inquiries, contact security@dumptruckboss.com or privacy@dumptruckboss.com.