Verified user identity
The application accepts user and tenant identity only from a trusted authentication edge that removes caller-supplied identity headers before injecting verified values.
Security
Trust boundaries are part of the product architecture.
The first MVP is designed around verified identity, tenant isolation, least-privilege service access and auditable activity.
Tenant-scoped data
Shipment reads, lists, knowledge records and audit events are partitioned by tenant. Cross-tenant reads are treated as not found.
Dedicated service identity
Calls to CargoGoWhere use short-lived signed assertions and a dedicated secret rather than sharing public or unrelated internal credentials.
Traceable operations
Tracking and retrieval actions retain user, tenant and request correlation details to support troubleshooting and review.
Operating principles
Secure by default, explicit by exception.
- Least privilegeEach service receives only the identity and secret material needed for its role.
- No silent bypassAuthentication and technical access controls are not circumvented to obtain tracking data.
- Fast containmentIntegrations are designed for rate limiting, monitoring and rapid suspension when required.
- Reviewable deliveryChanges are developed through pull requests with automated checks before deployment.
Reporting a security concern
Existing pilot organisations should report concerns through their established onboarding contact and include “Security” in the subject or first line. Provide the affected URL and reproduction details, but do not include live credentials, customer shipment data or other sensitive information in the initial message.
General contact guidance is available on the contact page.