Security and your data

HaulProof is built and run by A3E Ecosystem Inc. in Ontario, Canada. This page says plainly how your data and your carriers' documents are handled today.

Where data is stored

• HaulProof's application and database run on servers in Ontario, Canada.
• Documents carriers upload (insurance certificates, CVOR and NSC abstracts) are stored in Canada and are read on our own servers; they are never sent to outside AI services.
• Email is sent and received through Zoho Mail's Canadian data centre. Card payments are handled by Stripe: card numbers never reach HaulProof.

How it's protected

• Every page and API call is encrypted in transit (HTTPS/TLS).
• Passwords are stored only as scrypt hashes with a unique salt; nobody at HaulProof can read them.
• Login sessions and API keys are stored only as SHA-256 hashes. A lost key can be revoked at any time.
• Cloud-export credentials you give us are encrypted with AES-256-GCM.
• Every form is protected against cross-site request forgery, logins are rate-limited, and pages send strict security headers (Content Security Policy, no framing).

Who can see what

• Your watchlists, alerts, searches and team are visible only to your organization, by role: owner, admin, member or viewer.
• A carrier's documents are shown only to the brokers it agreed to share them with (through its Verified link or in answer to a broker's request), and every opening is logged.
• Broker reports are reviewed by HaulProof before other members see them, never appear on public pages, and never show the name of the brokerage that filed them.
• Public carrier pages show only public government records (no tiers, no phone numbers, no street addresses).
• A3E staff access accounts only to run and support the service.

Backups and availability

• Customer data and uploaded documents are backed up every night to a separate disk in Canada and kept 14 days.
• A full restore from backup is tested every week.
• An outside monitor checks the site every 5 minutes and alerts us if it is down or if carrier data stops refreshing.

Your control

• Export your watchlists any time (CSV) or send scheduled exports to your own cloud storage.
• Ask us to delete your account and its data at [email protected]. Carriers can withdraw document consent the same way.

HaulProof does not hold a SOC 2 or ISO 27001 certification. If your security review needs more detail, write to [email protected].

Last updated October 26, 2026. When the way we host or handle data changes, this page changes first.