Security
Security that an enterprise buyer can sign off on
SOC 2 Type II, GDPR-compliant, data residency in EU, US, and AP, SSO with SCIM, audit log export, and a 99.95% uptime SLA. The security questionnaire should be a formality.
Controls
Six controls your security team will look for
The list below is not exhaustive. The full control matrix is in the SOC 2 report, available under NDA.
Encryption in transit + at rest
TLS 1.3 in transit. AES-256 at rest. Keys are rotated quarterly and managed in a hardware-backed KMS.
SOC 2 Type II
Audited annually. The latest report is available under NDA. Controls cover security, availability, and confidentiality.
Data residency
Pin data to EU, US, or AP regions at provisioning. Data never leaves the chosen region for processing.
SSO + SCIM
SAML 2.0 and OIDC. SCIM provisioning for automated user lifecycle. Okta, Azure AD, Google Workspace supported.
Audit log export
Every read and write is logged. The audit log is exportable to your SIEM via streaming export or daily snapshot.
99.95% uptime SLA
Enterprise plan includes a 99.95% uptime SLA with service credits. Status page at status.example.com.
Compliance
Compliance, in writing
The compliance documents are available under NDA. Request them through your contact or via the contact form.
- SOC 2 Type II: annual independent audit
- GDPR: DPA available, EU data residency supported
- CCPA: data subject rights supported
- ISO 27001: in progress, target Q2 2027
- HIPAA: available as an add-on for healthcare logistics
- TAPA FSR: available for high-value freight
FAQ
Security questions, answered
Are you SOC 2 Type II certified?
Yes. We are audited annually by an independent third party. The latest report is available under NDA. Request it through your contact at Logistics Tower or via the contact form.
Are you GDPR compliant?
Yes. We act as a processor for customer data. Our DPA is available on request. Data residency in the EU is supported. Data subject access requests are handled through the customer's admin.
Who are your subprocessors?
Our subprocessor list is published and updated 30 days before any change. The current list includes cloud infrastructure, transactional email, and error monitoring providers. No freight data is shared with marketing or analytics subprocessors.
What is your incident response process?
We follow a documented incident response plan: detect, contain, eradicate, recover, postmortem. Customer-facing incidents are communicated within 24 hours of confirmation. The postmortem is published to the affected customers.
Who at Logistics Tower can access our data?
Access is role-based and least-privilege. Production access is gated by SSO, MFA, and just-in-time elevation. Access is logged and reviewed quarterly. Customer support access is opt-in and time-boxed.
How long is data retained?
Data retention follows the customer's plan: 30 days (Operator), 180 days (Network), unlimited (Enterprise). On termination, data is deleted within 30 days. The audit log is retained for 7 years.
Need the SOC 2 report?
We will send the latest report and DPA under NDA. Reach out through the contact form.