DATA & SECURITY

Your loads. Your data. Your call.

Run Your Rig holds rate cons, broker contacts, BOLs, and dollar amounts that matter to your business. Here's exactly how it's stored, and what we do (and don't do) with it.

Where it lives

Your account, loads, stops, documents, and reports run on AWS in the United States (Ohio region). The database is hosted on MongoDB Atlas with daily backups. Files like rate-con PDFs, BOL photos, and COIs sit in encrypted S3 buckets with private ACLs.

In transit and at rest

Every connection between the app and our servers uses TLS 1.2+. Database storage and S3 uploads are encrypted at rest. Passwords are hashed with bcrypt; we never see them in plain text. JWTs expire and are scoped to a single account.

What we do with your rate cons

When you import a rate confirmation, the document is uploaded to your private S3 bucket and parsed for structured fields. The parser only looks at one rate con at a time, on demand. Your rate cons are not used to train any third-party AI model. We retain originals in your account so you have the source of truth when a broker disputes a number.

What we don't do

  • We don't sell your data. Not to brokers, not to factoring companies, not to anybody.
  • We don't share your rates with other carriers.
  • We don't look at your loads except when you ask us to (support tickets, debugging at your request).
  • We don't hand the iOS app a list of permissions it doesn't need. Location is opt-in, off by default.

Cross-product sharing with Dock Watch

Run Your Rig and Dock Watch share one backend and one login. Your loads, notes, and broker contacts stay private to your account. The only thing that flows over to Dock Watch is anonymized facility-level signal (average dwell at a shipper, for example), and only when you explicitly opt in to share. Personal dock notes never leave your account.

Your controls

  • Export. Pull all your loads to CSV from the web dashboard at any time.
  • Delete. Tap Me → Delete account in the iOS app. Your records are purged within 30 days; we keep nothing on backup tapes after the retention window expires.
  • Revoke. Sign out of every device, rotate your password, or remove a fleet member instantly from the admin panel.

Account access for the team

Right now there are two engineers and a support inbox. Production database access is limited to those two people, behind 2FA. Every read or write of customer data is logged. We'll formalize this further as we grow.

Reporting a vulnerability

Find something we should fix? Send us the details through our contact form with “Security” in the subject line and we'll get back to you within 48 hours. We don't have a paid bug-bounty yet, but we'll thank you publicly if you want the credit.