PROTECT THE PEOPLE. PROTECT THE RECORD.

Security & privacy

Practical controls, clear access and honest limits.

Regulations & reporting

Protected account accessServer checks, secure sessions and request limits.

Controlled sharingJob roles and links you can revoke.

Traceable recordsSaved revisions, evidence and document signatures.

Controls in the application

Account sessions: Server-verified sign-in. Secure, HttpOnly session cookies. Cross-site request checks and limits on account attempts.
Job access: Server-side membership and role checks control account records, job work and attached files. Access is checked again when AI reads saved sources.
Private information: Personnel and payroll records use separate access rules. A private form linked to a job can also be visible to that job’s managers.
Sharing: Read-only snapshots use expiring, revocable secret links. Anyone holding a full link can read it; downloaded copies cannot be recalled.
AI controls: Paid entitlement, verified email, credit reservations and service spending limits are enforced on the server. API secrets stay off the browser.
Browser protection: HTTPS, security headers, framing restrictions, content-type protection and no-store API responses help protect browser sessions.
Report history: Submitted form revisions retain prior versions. Recorded signatures are tied to document content; a changed document needs review.

Storage & processing

LoadHaulPlace uses Supabase for account authentication, Cloudflare D1 for application records and R2 for uploaded files. Cloudflare documents encryption at rest for D1 and R2. These are provider protections; they are not a LoadHaulPlace security certification.

AI analysis sends your question and selected content to OpenAI. Requests disable Responses API storage; provider processing and applicable retention policies still apply. Data residency in Canada or Australia is not guaranteed by this release. See our Privacy Policy for data handling and deletion details.

What your team should do

Use individual accounts, strong unique passwords and the minimum job role needed.
Protect shared devices. Offline drafts and downloaded files can remain after sign-out; use device encryption and a screen lock.
Check recipients before sharing. Revoke old links and export records to your approved retention system.
Test backups and recovery. Keep required records accessible for inspections and legal holds.

Report a security concern

Email support@loadhaulplace.com with the affected page and a short description. Do not include passwords, API keys or confidential records. For immediate site danger, use your site’s emergency procedures.

Application controls reviewed September 30, 2026.