Security built for the long haul.

HaulDesk AI handles real business conversations — freight bookings, shipment tracking, customer details, and proprietary logistics data. We treat security as a core product requirement, not an afterthought.

Our guiding principles:

• Minimal data — we only collect what we need to run the Service
• Least privilege — every component only accesses what it specifically requires
• Encryption everywhere — all data is encrypted in transit and at rest
• No raw audio storage — call audio is transcribed in real time and never stored
• Transparent sub-processors — we tell you exactly who touches your data

TLS Everywhere

All communication between your browser, our servers, and third-party APIs is encrypted using TLS 1.2 or higher (TLS 1.3 preferred). We enforce HTTPS on all endpoints — plain HTTP requests are rejected.

WebSocket Security

The HaulDesk dashboard uses an authenticated WebSocket (WSS) for live call updates. Every WebSocket connection is validated with a signed JWT before any data is sent. Connections from unknown origins are rejected server-side.

Twilio Media Stream

Call audio travels from Twilio to our server over a TLS-encrypted WebSocket (WSS) Media Stream. Audio packets are forwarded directly to Deepgram's STT API over a second encrypted WebSocket — the audio never touches our disk.

HSTS

Our domain enforces HTTP Strict Transport Security (HSTS) with a long max-age and includeSubDomains, preventing protocol downgrade attacks.

Database Encryption

All data is stored in MongoDB Atlas on AWS (us-east-1). Atlas encrypts data at rest using AES-256 encryption. Encryption keys are managed by Atlas's built-in key management (AWS KMS). We do not operate bare-metal database servers.

What We Store

• Call transcripts (text only — no audio files)
• Freight booking records (pickup, destination, freight details, customer name and phone)
• Shipment records (tracking number, status, origin/destination, driver info)
• Account data (company info, plan, AI configuration)
• Hashed passwords — bcrypt with a work factor of 12+, never stored in plain text

What We Do Not Store

• Raw call audio recordings — audio is streamed and transcribed in real time, never written to disk
• Credit card numbers or payment credentials — handled exclusively by Dodo Payments
• Social security numbers, health data, or other sensitive personal identifiers
• Plain-text passwords at any point in the authentication flow

JWT Authentication

The HaulDesk API uses short-lived JWT access tokens signed with HS256. Tokens are bound to your account ID and expire after 7 days. Tokens are transmitted via Authorization headers (Bearer) — never in URL query strings.

OTP Email Verification

Account creation and sensitive actions are gated behind a one-time password (OTP) sent to your verified email address. OTPs are single-use and expire after 10 minutes.

Rate Limiting

Authentication endpoints are rate-limited per IP address to prevent brute-force attacks. All API endpoints are rate-limited to protect service availability.

Internal Access

HaulDesk AI employees do not have routine access to your call transcripts or business data. Any access for debugging or support purposes requires explicit written authorisation, is logged, and is disclosed to you on request.

Understanding exactly what happens to your call data is important. Here is the complete flow for a single inbound call:

HaulDesk AI integrates with Twilio, Deepgram, Anthropic, Resend, and Dodo Payments. All API keys for these services are:

• Stored exclusively as server-side environment variables — never in source code, client bundles, or version control
• Never logged or exposed in error messages
• Never sent to the client-side browser under any circumstances
• Rotated immediately if we detect any potential exposure

Your Twilio credentials are stored encrypted in our database and are used solely to validate incoming webhook signatures and to place outbound calls during escalation. We do not have access to your full Twilio account — only the specific SID and token you provide.

We have reviewed the security posture of each sub-processor. Key facts:

In the event of a confirmed data breach or security incident affecting your data:

• We will notify affected Account Holders by email within 72 hours of confirming the breach
• The notification will describe: what data was affected, how it happened, what we have done, and what you should do
• We will report to relevant regulatory authorities as required by applicable law (GDPR, CCPA, etc.)
• A post-incident report will be published on this page within 30 days of resolution

Our on-call team monitors system alerts 24/7. Critical alerts trigger immediate investigation and, where necessary, service isolation to contain the incident.

We welcome security researchers who help make HaulDesk AI safer. If you discover a vulnerability, please follow these guidelines:

• Email your findings to navjotsumandev@gmail.com with a detailed description and reproduction steps
• Do not access, modify, or exfiltrate data belonging to other users
• Do not perform denial-of-service attacks or tests that could disrupt service
• Give us a reasonable time to investigate and fix the issue (we aim for 30 days) before public disclosure