Security

Encryption in transit

All traffic is served over HTTPS. In production, HTTP requests are redirected to HTTPS and HSTS is set (max-age one year) via Flask-Talisman, and the app trusts the load balancer's forwarded headers so the original HTTPS scheme is honoured.

Encryption at rest

Account data is stored in Postgres (Google Cloud SQL); generated files are stored in Google Cloud Storage when object storage is configured. Both are encrypted at rest using Google Cloud's platform-managed encryption. aclRate does not add a separate application-level encryption layer on top. When Cloud Storage is not configured, generated files live in a session-scoped workspace on the service instance and are removed when the session ends.

Authentication & sessions

• Sign in with Google OAuth or email + password. Passwords are scrypt-hashed — never stored in plaintext.
• Sessions use signed, HttpOnly cookies (SameSite=Lax; Secure in production) with a rolling timeout (default 6 hours).
• CSRF protection is enforced on state-changing requests.

Tenant isolation

Every account is a separate tenant. Account-scoped data — contracts, audit entries, carrier scorecards, saved scenarios and rate monitoring — is queried by tenant ID, so one tenant cannot read or modify another tenant's records. Carrier-side and shipper-side access are separate authorization surfaces.

AI data handling

The automated AI feature callers (executive summaries, negotiation briefs, anomaly notes, cover letters and carrier-weighting suggestions) send only aggregated statistics to the AI provider — lane counts, coverage percentages, margin totals and similar roll-ups — and never automatically transmit individual lane-level prices. The in-product assistant is interactive: it relays the question you type, so any specific values you choose to paste into the chat (lane prices, carrier names, rates) will be sent to the AI provider as part of your query. When no AI key is configured, all AI features fall back to a deterministic rules engine and nothing leaves aclRate's infrastructure. Every AI-generated output is labelled where it appears.

Data retention

• Audit log: kept 7 years, append-only — rows are never modified.
• Account data: retained while active; soft-deleted on closure, then purged after 7 years.
• Uploaded data & generated outputs: session workspaces are removed when the session ends (default 6-hour timeout); account uploads are purged after 12 months of inactivity.
• Share-link snapshots: kept until the link's TTL expires (default 7 days, maximum 14), then purged.
• Session logs: kept 90 days for abuse detection, then purged.

Sub-processors

• Google Cloud (GCP) — hosting, compute, and object storage (Cloud Storage).
• Anthropic (Claude) — AI features (primary).
• OpenAI — AI fallback for some surfaces, used only when an OpenAI key is configured.
• Google — OAuth sign-in.
• Stripe — billing and subscription management.

Data Processing Agreement (DPA)

A Data Processing Agreement is available on request. Contact us via the email address on file for your account (existing customers), or reply to any aclRate sales correspondence (prospects).

Vulnerability disclosure

Found a security issue? aclRate does not yet operate a dedicated public vulnerability-disclosure inbox. If you have an account, reply to any aclRate correspondence on file or open an in-app support request and we will route the report to the security responder. We aim to acknowledge reports within a few business days; a dedicated public disclosure address will be published when the Security Policy work lands.