Security & Data Protection

1. Infrastructure

Flow's application and database tiers run entirely on SOC 2 certified cloud infrastructure. Our production database is hosted on Supabase (managed Postgres) in AWS us-east-1. Our application is hosted on Vercel in the iad1 region (Washington DC, US East). A dedicated sync host pulls fuel-network pricing files over SFTP from networks that only publish that way, and forwards them into the same encrypted cloud pipeline. It is a retrieval relay, not a data store. API-based integrations (ELD, TMS, fuel-card platforms such as Relay) stay cloud-to-cloud and never touch that host.

2. Encryption

API traffic between Flow and your systems runs over HTTPS with TLS 1.2 or higher. Every integration endpoint Flow calls is an HTTPS endpoint, and nothing in our code lowers that floor. Some feeds arrive by file transfer rather than by API, because the fuel network or the carrier publishes them that way: network pricing files, dispatch snapshots, fuel transaction files, and settlement files can all arrive over SFTP. Those carry your operational data, not just public pricing, and they are encrypted in transit by SSH rather than by TLS.

Data is encrypted at rest in the database tier: Supabase states that all customer data is encrypted at rest with AES-256 and in transit via TLS. Integration secrets get a second layer on top of that: Flow wraps them in AES-256-GCM envelope encryption under a master key held outside the database, so a database-only compromise yields ciphertext rather than working credentials. That wrapping is rolling out by integration rather than all at once: some integration secrets are wrapped today, and the rest are protected by the database tier's own encryption at rest until their turn comes. A daily automated check watches the integrations already in scope, so a credential that should be wrapped cannot quietly revert to plaintext without us seeing it. We will tell you where any specific integration stands if you ask.

3. Payments and fuel card data

These are two different things and we keep them separate. Your ValveRide Flow subscription is billed through Stripe (PCI DSS Level 1). Card entry happens on Stripe's own hosted checkout and billing portal, so your billing card number never reaches our systems. What we store is Stripe's identifiers for your customer and subscription plus the truck count we bill on.

Fuel cards are not a payment method Flow can charge. Flow stores fuel card numbers from your fuel platform for one purpose: matching each fuel transaction to the right truck, driver, and plan so reconciliation and compliance reporting work. In the portal's fleet and reconciliation views those numbers are masked to the last six digits. Our fuel platform integrations read transactions; they do not issue charges, authorizations, or money codes, so connecting a fuel card to Flow cannot move money.

4. Tenant isolation

Flow is multi-tenant with two enforcement layers: every query is scoped to your carrier account at the application layer, and Postgres row-level security is enabled across all application tables as defense in depth. Your dispatch data, fuel transactions, and negotiated pricing are never visible to another carrier. Your negotiated fuel pricing is treated as confidential to you. It is never resold and never feeds any shared or cross-carrier dataset.

5. API credentials

ELD and fuel-platform credentials are stored server-side, encrypted at rest in the database tier, with the additional application-layer envelope described in Section 2 applied integration by integration as that rollout proceeds. Credentials are never present in our codebase, in browser-delivered code, or in logs. Wherever the vendor supports it, Flow connects with read-only scopes: we read dispatches, positions, and transactions; write access (for example, in-cab messaging) exists only where a feature explicitly requires it and is separately gated (see Section 6). You can revoke Flow's access at any time from your vendor's side, and we delete stored credentials on request or on termination.

6. You control anything driver-facing

Carrier accounts start in Shadow Mode: Flow generates fuel plans your team can review in the portal, but no SMS, email, or in-cab message goes to a driver until your administrators switch outbound delivery on in your own settings. Connecting your APIs cannot, by itself, cause a message to reach a truck.

7. Access control & audit

Role-based access control for your team, signed JWT sessions, two-factor step-up authentication on our internal admin console, and audit logging of sensitive operations, including plan generation and every suppressed or delivered driver-facing message.

8. AI data flow

ValveRide uses third-party AI providers to operate Flow and to support you. Today these are Anthropic (Claude) and xAI. They may process your carrier data on our behalf to:

• parse the text messages drivers send to Flow;
• answer support questions from your team, including questions about your own fleet;
• read, draft, and send replies to emails you send us;
• analyze usage to find and fix problems; and
• help our engineers maintain and debug Flow, including AI coding tools that can see the records involved in an issue. Depending on the issue, those records can include trips, driver details, fuel transactions, and pricing.

ValveRide sets the rules these tools follow, monitors their work, and you can ask for a person at any time. Email info@valveride.com to reach one. We do not use your carrier data, driver information, or messages to train AI models. Anthropic does not train models on API data. Every AI provider that can receive your carrier data is listed in Section 9.

Separately, we query public AI assistants with our own marketing questions, to track how Flow is described when buyers ask about fuel optimization. Those queries contain no carrier, driver, trip, or pricing data, so an assistant we use only that way is not listed as a subprocessor in Section 9. One surface works differently and is not part of your carrier account: our separate developer API can be called from an AI assistant the developer chooses, so a request made that way passes through whichever assistant they use. That channel carries only the trip details the developer supplies, never your connected ELD, TMS, or fuel platform data, and our privacy policy covers it.

9. Subprocessors

For every subprocessor in the table above, we rely on the vendor's standard terms shown in the last column, accepted when we opened our account. Where that column says DPA terms, they are the vendor's standard data processing terms. We will notify customers under a DPA before adding subprocessors that process their data.

10. Commitments

We commit to breach notification without undue delay, data deletion on termination, and no resale of customer data, ever. These terms are standard in our data processing agreement, available on request, alongside completed security questionnaires and mutual NDAs.

Data retention, export, and availability

These figures restate our Terms of Service (Sections 13.5, 20, and 22), which are the binding text. Last updated: October 13, 2026

• Availability: we target 99.9% monthly availability, excluding scheduled maintenance, third-party service or network outages, and force majeure.
• Operational records: trip records, fuel plans, driver communications, and audit logs are retained for your active subscription plus 12 months after termination.
• Pricing files: uploaded fuel pricing files and the per-carrier price observations derived from them are retained for 90 days from upload.
• Driver personal data: name, email, phone, and ELD identifiers are deleted on your written request or within 30 days after termination.
• Export on exit: for 30 days after termination you can request an export of your data in a commercially reasonable format. After that window we may delete it.
• Compliance records: audit logs and tax-relevant transaction records may be retained for up to 7 years for compliance purposes.
• Shared price intelligence: aggregated, de-identified retail-pricing observations are retained indefinitely and are not subject to deletion. Your negotiated pricing is never part of that dataset (Section 4).

11. Certifications & roadmap

Flow itself does not yet hold a SOC 2 attestation. Our infrastructure providers do, and a formal audit is on our roadmap as we scale. In the meantime we answer security questionnaires directly and will walk your IT team through the architecture on a call. ValveRide is finalizing cyber liability and technology errors and omissions coverage. Insurance details are available to customers on request.

12. Contact

Security questions or reports: info@valveride.com. If you believe you have found a vulnerability, we ask for coordinated disclosure and will respond promptly.

The legal documents behind this page:

• Privacy Policy
• Terms of Service
• SMS Opt-In (how drivers consent to Flow text messages)