Security & Trust
CarrierMark is the carrier's system of record. It holds the actual driver files. These are the controls that protect them, and the posture an insurer or enterprise broker reviews before routing carriers through CarrierMark.
Encryption everywhere
- Evidence files encrypted at rest with SSE-KMS; startup refuses to run outside dev with encryption off or without a configured key.
- TLS 1.2+/1.3 in transit on every hop: client ↔ API, API ↔ database, API ↔ object storage.
- Per-tenant customer-managed keys and a deny-unencrypted bucket policy are operator-supplied infrastructure (recommended IaC).
Field-level PII protection
- AES-256-GCM field encryption (authenticated: tampering fails the decrypt) is implemented and unit-tested.
- A per-tenant, per-field HMAC blind index supports equality search without ever decrypting the value.
- Being applied to the SSN / driver-license / DOB columns. The primitive is built; the column rollout is in progress.
Tenant isolation
- Every carrier-scoped route enforces server-side that a principal may only reach its own carrier's data; unscoped principals fail closed.
- Bare resource-by-id routes (driver, asset, finding, hold, document) re-check ownership before any read or write.
- Postgres row-level security is the planned DB-layer backstop; today the application gate is the enforced control.
Authentication & access control
- Provider-agnostic OIDC (Clerk / Auth0): every request is JWKS-verified; an alg allowlist rejects 'none' and HS* confusion.
- Three least-privilege roles: owner, safety manager, read-only.
- Fails closed: a half-configured or mislabeled-prod deploy refuses to accept spoofable headers.
Drug & alcohol confidentiality
- Drug & alcohol records are barred from release by default (49 C.F.R. § 382.405); the document-release endpoint runs the gate first.
- Release requires the employee's specific written consent scoped to the driver, data item, and named recipient (§ 40.321). Blanket consent is void.
- Litigation release runs only under a fully-satisfied § 40.323 stipulation (employee notified in writing), and auto-generates the notice.
Audit & access trail
- Append-only audit log of every change (who filed / verified / held what, when). Rows are never updated or deleted.
- A separate access log records document releases and denials with request context (IP, user-agent, request id); read-path coverage is expanding.
- Deletes are soft and logged; the file can always answer 'when did you know.'
Retention & legal hold
- FMCSA retention windows per record type (DQF, medical, drug & alcohol, inspections, accident register).
- A legal hold beats the retention clock: covered records cannot be destroyed while a hold is active.
- The spoliation defense, made operational and provable from the audit trail.
Compliance posture
- Engineered to the SOC 2 Type II / ISO 27001 control set (crypto policy + key management, logging, secure deletion).
- BYOK / customer-managed keys available as an enterprise option.
- A register of legal obligations (§§ 391.51, 382.401, 382.405, 40.321–.323) drives the retention engine.
Built for the demand side. Insurers and large brokers won't route their carriers' sensitive files through a tool they can't vouch for. This control set is the gate to that channel, and the channel is what turns a score into the benchmark.