Security
Built with security at every layer.
Cargo management data is operationally sensitive. RRMS is designed to keep it safe — from authentication through to storage and audit.
HTTPS everywhere
All traffic between your browser and the RRMS API is encrypted with TLS 1.2 or higher; older protocol versions are refused. The platform is served exclusively over HTTPS — plain HTTP requests are redirected to HTTPS.
JWT authentication
Sessions use short-lived JWT access tokens (15-minute expiry, HS256) with rotating 1-day refresh tokens, an idle timeout and an absolute session limit. Every refresh token is stored only as a keyed hash — never in plain text. Office and management accounts sign in with a one-time e-mail code as a second factor.
Password hashing
User passwords are hashed with Argon2 (the OWASP-recommended algorithm) before storage. Plain-text passwords are never written to disk or logs.
Rate limiting
Login endpoints are rate-limited to 10 attempts per 5 minutes per IP. Token refresh is limited to 20 per 5 minutes. Brute-force attacks are automatically blocked.
Cloud infrastructure
The API and database are hosted on Render's managed cloud in the EU (Frankfurt, Germany), behind a Cloudflare web-application firewall. The database is a managed PostgreSQL instance; every tenant's rows are separated by row-level security under a restricted database role. Encrypted nightly backups are kept for 30 days in Amazon S3 in the EU (Stockholm, Sweden).
Audit logging
All state-changing operations are written to an immutable audit log with user ID, action type, entity, timestamp, and request ID. Audit packs can be exported for regulatory review.
Security headers
The RRMS API sets the following security headers on every response:
X-Content-Type-OptionsnosniffX-Frame-OptionsDENYStrict-Transport-Securitymax-age=31536000; includeSubDomainsContent-Security-Policydefault-src 'self'Referrer-Policystrict-origin-when-cross-originResponsible disclosure
If you believe you have found a security vulnerability in RRMS, please report it to us privately before disclosing it publicly. We will acknowledge your report within 48 hours and aim to resolve confirmed vulnerabilities within 30 days.
Report a vulnerability