Security Overview
HaulFoundry uses layered administrative and technical safeguards designed to protect customer accounts, operational data, and the systems that run the service. This page summarizes the security practices currently used across HaulFoundry.
1. Account and Access Security
HaulFoundry uses authenticated user accounts and workspace-based access controls. Workspace permissions are assigned by role, including Owner, Dispatcher, and Viewer access.
Platform-level administrative access is maintained separately from normal customer workspace ownership. Administrative infrastructure is protected with multi-factor authentication and backup authentication factors where supported.
2. Database and Workspace Isolation
HaulFoundry uses server-side access controls and database Row Level Security policies to help prevent users from accessing or modifying data outside the workspaces they are authorized to use.
Sensitive database operations use server-side authorization checks rather than relying only on browser-side controls. Subscription entitlement and workspace-access rules are also enforced on the backend.
3. Application and API Security
HaulFoundry limits privileged database functions and applies least-privilege permissions to backend operations. Public application functions are separated from private authorization logic where appropriate.
Production security reviews include checks for exposed credentials, unintended database permissions, authentication bypasses, and source-control drift.
4. Data Transmission and Credentials
HaulFoundry is served over encrypted HTTPS connections. Authentication, database, hosting, billing, and related infrastructure are provided through established service providers.
Server-side secrets are not intended to be embedded in browser code or committed to the public application repository. HaulFoundry's production repository has been reviewed for exposed Stripe secrets, Supabase service credentials, private keys, and similar sensitive credentials.
5. Billing Security
Subscription payments are processed through Stripe. HaulFoundry does not intend to store raw payment-card or bank-account credentials in its core application database.
6. Recovery and Change Control
HaulFoundry maintains source-controlled database migrations and application code so production systems can be traced back to reviewed source changes. Database rebuild procedures have been tested from source-controlled migrations.
HaulFoundry maintains recovery and rollback procedures covering application deployments, database changes, authentication issues, billing incidents, backend functions, and production smoke testing.
7. Logging and Incident Response
HaulFoundry and its infrastructure providers may maintain application, authentication, database, billing, and security logs used for troubleshooting, auditing, misuse detection, and incident investigation.
Suspected security incidents are investigated and addressed based on their scope and severity. Where notification is required by applicable law or contract, HaulFoundry will provide notice consistent with those obligations.
8. Customer Responsibilities
Customers are responsible for protecting their account credentials, controlling who has access to their workspace, assigning appropriate user roles, and removing access when it is no longer needed.
Customers should avoid placing highly sensitive information such as Social Security numbers, payment credentials, authentication codes, detailed medical records, or other unnecessary sensitive information into HaulFoundry free-text fields.
9. Security Questions and Reports
If you believe you have discovered a security issue involving HaulFoundry, please contact:
HaulFoundry LLC
Support: support@gethaulfoundry.com
Website: gethaulfoundry.com