Security and data handling
Track That Ride keeps each company’s data separate, hashes passwords, PINs and API keys, signs customer tracking links and makes them expire, signs every webhook, and serves everything over HTTPS. We hold no security certifications, so this page lists the specific measures in place instead.
-
Each company’s data is kept separate
Every delivery, driver, customer and zone belongs to one company, and every query is limited to the signed-in company. Drivers can only see and change the deliveries assigned to them.
-
Tracking pages show only what the recipient needs
Customer tracking links are signed so they cannot be guessed, stop working seven days after the delivery ends, and use a fixed allow-list of fields: no phone numbers, email addresses, delivery codes or internal notes. Delivery codes are shown only after the recipient verifies their phone number.
-
Passwords, PINs, codes and keys are stored hashed
Account passwords, driver PINs, delivery codes and API keys are stored as bcrypt hashes, never in plain text. Hash and code columns are also stripped from every API response as a second safeguard.
-
Logins are rate limited and drivers are locked out after repeated failures
Login, password reset and tracking-page verification are rate limited. Ten failed driver PIN attempts lock that driver for fifteen minutes.
-
Sessions and requests are protected
The site is served over HTTPS only, with HSTS. Session cookies are HTTP-only, Secure and SameSite, and expire after a day. Requests that change data from the browser need a CSRF token.
-
API keys are scoped and revocable
Each API key carries its own permissions per resource and its own rate limit, and can be rotated or revoked at any time.
-
Webhooks are signed
Every webhook is signed with HMAC-SHA256 using a secret only you and we hold, so your server can reject anything that did not come from us. You can rotate the secret.
-
Proof-of-delivery files are private
Photos and signatures are stored in private object storage and shared only through links that expire.
Security questions
Do you hold any security certifications?
No. We do not currently hold a formal security certification, so this page describes the specific measures in place instead. If your client requires a certification, contact us before signing up.
Where is data stored?
The application and database run on Railway’s cloud platform, and proof-of-delivery files are kept in private, S3-compatible object storage. Contact us if you need specific details for a data protection assessment.
How do I report a security issue?
Email help@trackthatride.com with the details. Please do not test against other customers’ data.
Related
- Privacy policy
How we handle personal data.
- All features
Live tracking, customer links, proof of delivery and the audit trail, feature by feature.
- Authentication
API keys, permissions and how to send them.
- Webhooks
Events, payloads and signature verification.