Security
Your data, your authority, on the record
What protects your data and who can act on it, described as it’s built. No badges, and no certification we don’t have.
Your data
Walled off at the database
- Tenant isolation
- Each carrier’s data is separated with PostgreSQL row-level security. The app runs as a database role that can’t get around it.
- Tested
- A cross-tenant probe signs up two carriers and makes about 36 attempts to read or change the other’s records. It finds no leaks, even with the app’s own check deliberately broken.
- Passwords
- Stored as scrypt hashes. The password itself is never stored.
- Sessions
- Opaque tokens, stored only as digests, with idle and absolute expiry.
- Reset links
- Single use and expiring. Resetting a password ends every session.
Your authority
Who can act, and on what
Roles
Specific permissions
Who may approve, book, change rules or only look. Tenancy is checked before anything else.
Approvals
Over the limit, you decide
Outside your rules, a person approves. A decline is a hard stop.
Audit
Append-only
Material actions are kept with who, when, what went in and what came out.
Pause
One switch
Designed to stop all new automated work across the account.
Transparency
An AI that says so
Rudy is designed to tell every broker, at the start of every call, that it’s an AI dispatcher calling for your carrier. The plan is a recording and transcript of every call, kept with the load. No calls are placed today.
Straight answers
What we claim, and what we don’t
- Certifications
- Dispatch does not claim SOC 2 or any independent security certification. This page will say so when one is complete.
- Diligence
- Design partners and investors can see where each part of the product stands on the product status page.
- Report a problem
- Found a security issue? Email hello@letdispatch.com.