Trust Center
Trust, Security & Compliance
Your logistics, financial and personal data is critical to your business. This is how CargoSurge protects it — the controls we run, the standards we hold ourselves to, and the partners we trust with your data.
99.9%
Uptime target
Monthly uptime target with transparent status reporting
AES-256
Encryption
Strong encryption for data at rest and TLS in transit
Row-level
Tenant isolation
Database-enforced isolation between every organization
RBAC + MFA
Access
Role-based access with multi-factor authentication
Compliance & Certifications
We're transparent about where we are. Some standards are live today; others are on a defined roadmap, built on the same control set.
ISO/IEC 27001:2022
In progressWe operate an Information Security Management System (ISMS) with a completed risk register and Statement of Applicability covering all 93 Annex A controls. Certification is underway.
SOC 2 Type II
PlannedOn our compliance roadmap, building on the same control set as our ISO 27001 program.
GDPR
LiveData-subject rights (access, erasure, portability) supported; Data Processing Agreement available.
UAE PDPL & KSA PDPL
LiveAligned with GCC personal-data-protection requirements for the markets we serve.
ZATCA e-invoicing (KSA)
LivePhase-2 (Fatoora) e-invoicing capabilities built into the finance module.
Data Processing Agreement (DPA)
LiveAvailable on request for customers who need one in place.
How We Protect Your Data
Security is not an afterthought — it is fundamental to how CargoSurge is architected, deployed, and maintained, at every layer.
Data Encryption
- AES-256 encryption for data at rest
- TLS 1.2+ encryption for all data in transit
- Column-level encryption for sensitive fields and secrets
- Encrypted database backups; secure key management with rotation
Multi-Tenant Data Isolation
- Row-level security enforced at the database layer
- Every query scoped to the tenant; no cross-tenant access by design
- Cross-tenant leakage is treated as a P0 incident
- Isolated handling of sensitive operations
Access Controls
- Role-based access control (RBAC) with granular permissions
- Multi-factor authentication (MFA) for privileged access
- Single sign-on (SSO / OAuth) support
- Least-privilege by default; quarterly access reviews
Infrastructure Security
- Cloud-hosted on AWS with network segmentation
- DDoS protection and web application firewall (Cloudflare)
- Automated, encrypted backups with point-in-time recovery
- Immutable containers; production changes only via CI/CD
Monitoring & Response
- Comprehensive audit logging of security-relevant actions
- Security Command Center with HIGH/CRITICAL alerting
- Continuous vulnerability scanning (SAST + dependency scanning in CI)
- Documented incident response plan with severity-based handling
Secure Development
- Peer review + security gates in the CI pipeline before deploy
- Parameterized queries only (no raw SQL); input validation & output sanitisation
- Separated development, test and production environments
- Dependency updates monitored and patched (Dependabot)
Sub-processors
We use a small set of reputable providers to run the platform. Each is assessed for security before use and reviewed periodically.
| Provider | Purpose | Data processed |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, storage and encrypted backups | All platform data |
| Cloudflare | CDN, DDoS protection and web application firewall | Request metadata |
| Stripe | Subscription billing and payment processing | Billing contact + payment metadata |
| Resend / Amazon SES | Transactional and notification email delivery | Recipient address + message content |
| AI providers (optional) | AI Assist features, only when enabled by your tenant | Only the data you submit to the assistant |
Data is hosted on AWS; regional data-residency options are available on request. The current, complete sub-processor list is provided in our Data Processing Agreement.
Privacy & Your Data Rights
You own your data. We process it only to provide the service, never sell it, and support your rights to access, correct, export and delete personal data.
Read our Privacy Policy- Data-subject requests (access, erasure, portability) honoured
- Data minimisation — we collect only what the service needs
- Clear retention: business records soft-deleted, footage tiered
- Breach notification in line with PDPL / GDPR timelines
Request our security package
Running a vendor review? We can share our security overview, Statement of Applicability summary, and a Data Processing Agreement under NDA.
Responsible Disclosure
We take security vulnerabilities seriously. If you discover a potential issue, please report it responsibly — we appreciate your help in keeping CargoSurge safe for everyone.
Questions About Security?
Our team is happy to discuss our security practices, provide documentation, or address any specific compliance requirements you may have.
Last reviewed: July 2026