Security
What is built to keep your data separate, and what we do not have yet.
Plain statements of what NemiRoute does today, so you can answer your own customers’ questions. No badges we have not earned.
In place
Tenant isolation, roles, two-factor sign-in, an activity log, signed webhooks, privacy tools, a DPA and a subprocessor list.
Not yet
No SOC 2 or ISO 27001 report and no HIPAA attestation. We answer security questionnaires directly.
In the product
Controls you can use
- Separate tenants
- Each courier company is its own tenant. Every query is scoped to the company, and its customers and drivers sign in to their own portals. A cross-tenant isolation test suite runs against the API.
- Roles and permissions
- Preset roles and custom ones: read, edit, create and delete per area. What a role cannot do is hidden, not only disabled.
- Two-factor sign-in
- Authenticator-app codes for staff accounts, and sign-in with Google or Microsoft when you turn it on.
- Sessions
- See where you are signed in and sign out other sessions. Accounts lock for 15 minutes after 5 failed attempts.
- Activity log
- Who changed what and when, with the record and the result. Price overrides and proof waivers require a reason.
- Visible support access
- When platform support opens your account to help you, a banner shows it on screen and it is written to the log.
How it is built and run
Under the hood
- Passwords and secrets
- Passwords are hashed with scrypt; API keys are shown once and stored hashed; webhook calls are signed.
- Web protections
- HTTPS with HSTS, a content security policy, cross-site request checks and rate limits on sign-in and APIs.
- Uploads
- Files are checked by their content, not their name, and served from private storage with short-lived links.
- Backups
- The operations runbook requires point-in-time database backups and a weekly test restore.
- Driver devices
- Short-lived sign-in tokens (15 minutes), outdated app versions refused, remote sign-out.
- Monitoring
- Health endpoints, a request id on every error and structured logs for each request.
Privacy
Privacy tools for you and your customers
Data requests, retention and legal holds are part of the product, so you can answer the people whose data you hold.
- Access and deletion requests, tracked to completion
- Retention rules per kind of data
- Legal holds that pause deletion
- Consent and opt-outs for texts and emails
Questionnaires and reports
Ask us directly
If your customers send you a security questionnaire, send it to us and we answer it. To report a vulnerability, write to support@nemiroute.com.