# Privacy and data

What data Shipment Insight stores, how driver location is protected, how long data is kept, how your data is kept separate from other customers, and how you can see who accessed it.

> **Preview:** The console currently shows only simulated data. No customer, carrier or driver data is stored yet. This page describes how real data will be handled when the platform goes live.

## What we store

| Data | Examples | Why |
| --- | --- | --- |
| Account | Name, work email, language, role. | To sign you in and show you the right data. |
| Shipments | References, stops, appointments, carrier, equipment. | The core of the service. |
| Tracking | Positions, milestones and their sources. | To show where shipments are and predict arrivals. |
| Raw messages | The original EDI, API or ELD message, unchanged. | To fix errors, reprocess data, and as evidence in disputes. |
| Security records | Sign-ins, devices, changes to roles and keys. | To protect your account and for your audit log. |

Your data is used to provide the service to you. Prediction models may learn from aggregated, de-identified data across customers; you'll be able to opt out of this.

## Driver location

A truck's position is often a driver's position, so we treat it as personal data:

- Positions are collected **only during an active shipment**, from pickup to delivery.
- Drivers using the driver app or link give **explicit consent** first, and see when they're being tracked.
- Each party sees positions only for the shipments they're part of.
- Phone numbers and similar contact details get an extra layer of encryption.
- Position history is kept for a limited time (see below), not forever.

## How long we keep data

| Data | Kept for |
| --- | --- |
| Account and shipment records | As long as your organization uses Shipment Insight. |
| Detailed position trail | 90 days for the live map and timeline; longer history only in aggregated or archived form. |
| Raw inbound messages | At least 13 months, adjustable per organization and legal need. |
| Security and audit records | Long enough to investigate incidents and meet audit needs. |

When an organization leaves, its data is deleted after a grace period. Requests from individuals (for example, a driver asking what we hold about them) are supported.

## Your data stays yours

- Every record is tagged with the organization it belongs to.
- The database itself refuses to return another organization's records, not just the application. This is tested automatically on every change.
- Other organizations only see a shipment you share with them, and only the fields their role needs. See [Roles and access](https://shipmentinsight.com/docs/roles-and-access#sharing).
- Pages and records you can't access look like they don't exist.

## Encryption

- In transit: TLS everywhere, including between our own services.
- At rest: all databases, files and backups are encrypted.
- Extra encryption for the most sensitive fields, such as partner credentials and driver phone numbers.
- Backups are encrypted, stored in a second region, and restore-tested.

## Your audit log

Your organization will have an audit log of who did what: sign-ins, role changes, API keys created or revoked, shares granted, settings changed. Admins can view and export it. The log is append-only and tamper-evident.

## Shipment Insight staff access

- Staff don't have standing access to your data.
- When support needs to look, access is requested for one organization, with a reason and a time limit, and approved by a second person.
- Staff sign in with a hardware security key.
- Every time staff open your data, it's recorded in **your** audit log, so you can see it.

## Where data is stored

> **PLANNED:** We plan to offer data storage in the **United States** and in **Canada**, chosen per organization. The regions available at launch will be announced before go-live.

## Compliance

Shipment Insight is being built with Canadian and US privacy laws in mind, including PIPEDA, Quebec's Law 25 and the CCPA. A **SOC 2** audit is planned; we don't hold a SOC 2 report or any other certification yet. We'll say so here when that changes.