How we protect your freight data

• Sign-in uses email & password and Google sign-in through our managed authentication provider. Sessions are stored client-side and validated on every server request.
• Every workspace request is scoped to the signed-in user and their organization membership. Backend row-level security policies enforce this on every read and write, in addition to checks in the application code.
• Privileged actions (workspace administration, billing, member management) require explicit roles assigned inside the workspace.

• Shipment, customer, driver, truck, and document records are isolated per organization. Members of one workspace cannot read or modify data belonging to another workspace.
• Internal documents (those not marked customer-visible) are restricted to the shipment owner. Customer-visible documents are readable by other members of the same workspace.
• Sensitive fields such as invite tokens and billing identifiers are not exposed through the application API to regular members or admins.
• Uploaded files are stored in a private object-storage bucket and served through short-lived signed URLs scoped to the requesting user.

• Public shipment-tracking links use unguessable tokens and expose only the information needed to follow a shipment — never internal notes, customer contact fields, or internal documents.
• Workspace admins can revoke a tracking link at any time by archiving the shipment or regenerating the token.

Ruty is built on the Lovable platform, which provides managed hosting, database, and authentication services. Additional integrations such as carrier-tracking providers are only activated when a workspace admin enables them. We do not sell customer data.

Security on Ruty is shared between the Ruty team (application controls and data isolation), the underlying platform (infrastructure, network, and managed services), and your workspace (strong passwords, careful role assignment, and keeping invite links private). We recommend reviewing workspace members and outstanding invites periodically.

If you believe you have found a security vulnerability, please contact your Ruty workspace administrator, who can escalate the report to our team. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate it.