Security Standards & Architecture
Status: Active Production • Contact: saam@cargo-optix.com
1. Zero-Exposure Manifest Processing
Unlike legacy cloud logistics software that forces clients to transmit proprietary bill-of-lading and SKU manifests to remote servers, CargoOptix executes its bin-packing and load-planning solver locally in your browser, in JavaScript running in a background worker, with WebGL for the 3D view. Your freight manifests, cargo dimensions, and bill of materials never touch our servers.
2. Data Encryption in Transit & at Rest
- In Transit: HTTPS only, with TLS 1.2 or newer (TLS 1.3 where your browser supports it), forward secrecy, and HTTP Strict Transport Security (HSTS). Plain HTTP is redirected to HTTPS, and TLS 1.0 and 1.1 are refused.
- At Rest: Customer account and subscription records are encrypted at rest by our database provider, Supabase, using AES-256.
3. Row-Level Security (RLS) & Multi-Tenant Isolation
CargoOptix enforces PostgreSQL Row-Level Security (RLS) on every table within Supabase. Even in multi-tenant environments, database queries are cryptographically constrained by authenticated JSON Web Tokens (JWT). Unauthorized cross-tenant reads or writes are programmatically blocked by database engine policies.
4. Payment Security & PCI-DSS
All subscription payments and pay-as-you-go run packs are processed by Paddle.com, our online reseller and Merchant of Record, which is PCI-DSS certified. Payment card numbers, CVVs, and expiry dates are never transmitted through or stored on our infrastructure.
5. Vulnerability Disclosure & RFC 9116
We welcome security researchers and customers to review our posture and report potential vulnerabilities responsibly. Our canonical security policy and disclosure channels are published at /.well-known/security.txt.
Security reports and vulnerability inquiries: saam@cargo-optix.com