How we protect your shipment data.
Tracking software holds your shipment data, so it is fair to ask how we protect it. Here is what we do, in plain terms.
HostingAWS cloud infrastructure
Transactional emailAmazon SES
Signing in
- Two-factor by default. Sign-in is protected by an email one-time code: a 6-digit code, valid for 5 minutes, single-use, with resend and attempt limits. Codes are stored only as a salted hash, never in plain text.
- Passwords are hashed with bcrypt — we never store or can read your password.
- Sessions are signed tokens held in httpOnly cookies, so they cannot be read by page scripts. A "trust this device" option skips the code for 30 days on that device only.
Your data
- Encryption in transit. All traffic is served over HTTPS/TLS.
- Per-workspace isolation. Every account's shipments are scoped to that account; one customer cannot see another's data.
- Minimal sharing with tracking providers. To trace a shipment we send our data providers identifiers only — container, bill-of-lading or booking numbers — never party names, contacts or cargo values.
Payments
Payments are handled by Stripe. Card details are entered on Stripe and never touch our servers.
Hosting & sub-processors
ShipTastic runs on cloud infrastructure (AWS). Transactional email (verification codes, receipts) is sent through Amazon SES. The full list is in our Privacy Policy.
Reporting a vulnerability
Found a security issue? Please email connect@robotasticlimited.com with the details and we will respond. Please do not publicly disclose until we have had a chance to fix it.
Enterprise sign-in
Single sign-on with your own identity provider (SAML or OpenID Connect) is set up on request for Enterprise workspaces. Audit logs are on the roadmap.