Security & Data Protection

1. Infrastructure

Flow's application and database tiers run entirely on SOC 2 certified cloud infrastructure: Vercel (application hosting) and Supabase on AWS (managed Postgres). A dedicated sync host pulls fuel-network pricing files over SFTP from networks that only publish that way, and forwards them into the same encrypted cloud pipeline. It is a retrieval relay, not a data store. API-based integrations (ELD, TMS, fuel-card platforms such as Relay) stay cloud-to-cloud and never touch that host.

2. Encryption

API traffic between Flow and your systems runs over HTTPS with TLS 1.2 or higher. Every integration endpoint Flow calls is an HTTPS endpoint, and nothing in our code lowers that floor. Some feeds arrive by file transfer rather than by API, because the fuel network or the carrier publishes them that way: network pricing files, dispatch snapshots, fuel transaction files, and settlement files can all arrive over SFTP. Those carry your operational data, not just public pricing, and they are encrypted in transit by SSH rather than by TLS.

Data is encrypted at rest in the database tier. Integration secrets get a second layer on top of that: Flow wraps them in AES-256-GCM envelope encryption under a master key held outside the database, so a database-only compromise yields ciphertext rather than working credentials. That wrapping is rolling out by integration rather than all at once: some integration secrets are wrapped today, and the rest are protected by the database tier's own encryption at rest until their turn comes. A daily automated check watches the integrations already in scope, so a credential that should be wrapped cannot quietly revert to plaintext without us seeing it. We will tell you where any specific integration stands if you ask.

3. Payments and fuel card data

These are two different things and we keep them separate. Your ValveRide Flow subscription is billed through Stripe (PCI DSS Level 1). Card entry happens on Stripe's own hosted checkout and billing portal, so your billing card number never reaches our systems. What we store is Stripe's identifiers for your customer and subscription plus the truck count we bill on.

Fuel cards are not a payment method Flow can charge. Flow stores fuel card numbers from your fuel platform for one purpose: matching each fuel transaction to the right truck, driver, and plan so reconciliation and compliance reporting work. In the portal's fleet and reconciliation views those numbers are masked to the last six digits. Our fuel platform integrations read transactions; they do not issue charges, authorizations, or money codes, so connecting a fuel card to Flow cannot move money.

4. Tenant isolation

Flow is multi-tenant with two enforcement layers: every query is scoped to your carrier account at the application layer, and Postgres row-level security is enabled across all application tables as defense in depth. Your dispatch data, fuel transactions, and negotiated pricing are never visible to another carrier. Your negotiated fuel pricing is treated as confidential to you. It is never resold and never feeds any shared or cross-carrier dataset.

5. API credentials

ELD and fuel-platform credentials are stored server-side, encrypted at rest in the database tier, with the additional application-layer envelope described in Section 2 applied integration by integration as that rollout proceeds. Credentials are never present in our codebase, in browser-delivered code, or in logs. Wherever the vendor supports it, Flow connects with read-only scopes: we read dispatches, positions, and transactions; write access (for example, in-cab messaging) exists only where a feature explicitly requires it and is separately gated (see Section 6). You can revoke Flow's access at any time from your vendor's side, and we delete stored credentials on request or on termination.

6. You control anything driver-facing

Carrier accounts start in Shadow Mode: Flow generates fuel plans your team can review in the portal, but no SMS, email, or in-cab message goes to a driver until your administrators switch outbound delivery on in your own settings. Connecting your APIs cannot, by itself, cause a message to reach a truck.

7. Access control & audit

Role-based access control for your team, signed JWT sessions, two-factor step-up authentication on our internal admin console, and audit logging of sensitive operations, including plan generation and every suppressed or delivered driver-facing message.

8. AI data flow

Flow uses large language models for two features, and we are precise about what they see. Driver SMS parsing sends only the text of the driver's message to Anthropic's API. No names, phone numbers, or account identifiers accompany it. The in-portal support assistant sends the question your team typed plus our own product documentation. No fuel pricing contracts, credentials, or financial data are included in any AI prompt. Anthropic does not train models on API data.

Anthropic is the only AI provider that receives any of your carrier data. We do query other public AI assistants, but only with our own marketing questions, to track how Flow is described when buyers ask about fuel optimization. Those queries contain no carrier, driver, trip, or pricing data, which is why those vendors are not listed as subprocessors in Section 9. One surface works differently and is not part of your carrier account: our separate developer API can be called from an AI assistant the developer chooses, so a request made that way passes through whichever assistant they use. That channel carries only the trip details the developer supplies, never your connected ELD, TMS, or fuel platform data, and our privacy policy covers it.

9. Subprocessors

Vercel (hosting), Supabase/AWS (database), DigitalOcean (pricing-file sync host), Stripe (payments), Twilio (SMS), Resend (email), Anthropic (AI features), HERE (routing). We will notify customers under a DPA before adding subprocessors that process their data.

10. Commitments

We commit to breach notification without undue delay, data deletion on termination, and no resale of customer data, ever. These terms are standard in our data processing agreement, available on request, alongside completed security questionnaires and mutual NDAs.

11. Certifications & roadmap

Flow itself does not yet hold a SOC 2 attestation. Our infrastructure providers do, and a formal audit is on our roadmap as we scale. In the meantime we answer security questionnaires directly and will walk your IT team through the architecture on a call. ValveRide carries cyber liability insurance. A certificate of insurance is available under NDA.

12. Contact

Security questions or reports: info@valveride.com. If you believe you have found a vulnerability, we ask for coordinated disclosure and will respond promptly.