Skip to content

Security

We take the security of CargoParse and our customers' data seriously. If you've found a vulnerability, we want to hear about it.

Reporting a vulnerability

Email security@cargoparse.com with a description of the vulnerability, steps to reproduce, and any relevant screenshots or logs. We will acknowledge your report within 5 business days.

Scope

In scope:

  • cargoparse.com and dev.cargoparse.com
  • CargoParse API endpoints (api.cargoparse.com, /api/*)
  • CargoParse mobile app (iOS and Android)
  • Authentication and authorization flaws
  • Data exposure or leakage
  • Injection vulnerabilities (SQL, XSS, command injection, etc.)

Out of scope:

  • Social engineering attacks against CargoParse employees or users
  • Denial of service (DoS/DDoS) attacks
  • Physical security
  • Third-party services (Stripe, AWS, Google) — report to them directly
  • Issues already known or previously reported

What to expect

  • We will acknowledge receipt within 5 business days
  • We will provide an initial assessment within 10 business days
  • We will keep you informed of our progress toward a fix
  • We ask that you give us a reasonable window to address the issue before any public disclosure

Bug bounty

We do not currently operate a paid bug bounty program. We are happy to publicly credit security researchers (with your permission) for responsibly disclosed vulnerabilities.

Infrastructure overview

CargoParse runs on AWS (us-east-1). All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Authentication is handled by AWS Cognito with optional MFA (authenticator app). API keys use SHA-256 hashing — plaintext keys are never stored. See our Privacy Policy and Sub-processors page for details on data handling and third-party services.