The application runs on Vercel and the database is Postgres on Neon, both in the United States. Uploaded documents sit in a private Vercel Blob store that has no public URL. All traffic is encrypted in transit (TLS with HSTS). Database backups are encrypted; a deleted account leaves them within 90 days, as the Privacy Policy states.

• Passwords are hashed with scrypt and a per-account random salt, and checked in constant time. We cannot read a password, and a sign-in attempt for an address that doesn't exist takes the same time as one that does.
• A session is a random token in an HttpOnly, Secure, SameSite cookie that expires after 30 days. The database stores only the SHA-256 of the token, so a copy of the database yields no usable sessions.
• Signed-in pages are sent with Cache-Control: no-store, so the browser's Back button cannot show a page after sign-out.
• Sign in with Google asks for openid email profile only. We never see a Google password and request no other scope.
• Password resets and email confirmation use single-use links sent to the address on file.

• Every read and write is scoped to the carrier the signed-in user belongs to. The only views that span accounts are a preparer's own client list and the operator console.
• A USDOT number that is already connected to an account cannot be claimed by a second sign-up; the second person is told the carrier is already connected.
• A preparer's clients are each their own account. The preparer sees only the clients they hold, and one client never sees another.
• A glovebox link you create for a driver is a long random token that shows only the documents you put in the permit book. Delete the link and it stops working.

• Permit-book documents (cab cards, IFTA licence, 2290 Schedule 1 and the rest) are stored in the private Blob store and served only through a signed-in request or a glovebox link.
• ELD and fuel-card exports are parsed on upload. What we keep is the rows: miles by jurisdiction, fuel purchases, the vehicles they belong to. You can download all of it from the audit archive at any time (trips, fuel, return and vehicles as CSV).
• The free files check at /tools/ifta-return-from-files stores nothing: the files are parsed, the result is rendered, and the request ends.

Dodo Payments is the merchant of record. Card numbers are entered on Dodo's checkout and never reach our servers; we hold your plan, invoices and the subscription identifiers Dodo gives us. Every webhook from Dodo is verified against the signing secret before it can change a plan, and each event is processed once.

The Copilot and the readers for PDF statements and documents use Anthropic's Claude. Only the content needed for the request is sent, and Anthropic does not train on it. The AI never computes a tax figure, a due date or whether a rule applies: those come from tested code, and the AI reports what the code returns. See how the numbers are sourced.

Account, alert and informational emails go out through Resend. Inbound delivery events are accepted only with a valid signature. Our sending domains publish SPF, DKIM and DMARC records, and every informational email carries a one-click unsubscribe that is honoured before the next send.

• The operator console is limited to an allow-list of operator addresses. Actions taken there are written to an audit log, and deleting a client requires typing that carrier's USDOT.
• Sign-in, password reset, the free tools, the contact form and the AI routes are rate-limited.
• A daily health report checks deployments, errors, the scheduled jobs and email delivery, so a failure is noticed within a day rather than when someone complains.

Export your records from the audit archive whenever you like. To close an account, email support@truepermitdot.com from the address on the account; the account and its carrier data are deleted within 30 days, and invoices stay with Dodo Payments as long as tax law requires.

• Two-factor authentication. Use a long, unique password or Sign in with Google.
• A third-party audit report (SOC 2 or similar). This page describes what is in place; it is not an attestation.
• A bug-bounty program. Reports are welcome all the same, see below.

If you believe you have found a security issue, email support@truepermitdot.com with “Security” in the subject. A person reads it within one business day. Please do not access data that is not yours while testing; tell us what you saw and we will take it from there.