Security
We take the security of CargoParse and our customers' data seriously. If you've found a vulnerability, we want to hear about it.
Reporting a vulnerability
Email security@cargoparse.com with a description of the vulnerability, steps to reproduce, and any relevant screenshots or logs. We will acknowledge your report within 5 business days.
Scope
In scope:
- cargoparse.com and dev.cargoparse.com
- CargoParse API endpoints (api.cargoparse.com, /api/*)
- CargoParse mobile app (iOS and Android)
- Authentication and authorization flaws
- Data exposure or leakage
- Injection vulnerabilities (SQL, XSS, command injection, etc.)
Out of scope:
- Social engineering attacks against CargoParse employees or users
- Denial of service (DoS/DDoS) attacks
- Physical security
- Third-party services (Stripe, AWS, Google) — report to them directly
- Issues already known or previously reported
What to expect
- We will acknowledge receipt within 5 business days
- We will provide an initial assessment within 10 business days
- We will keep you informed of our progress toward a fix
- We ask that you give us a reasonable window to address the issue before any public disclosure
Bug bounty
We do not currently operate a paid bug bounty program. We are happy to publicly credit security researchers (with your permission) for responsibly disclosed vulnerabilities.
Infrastructure overview
CargoParse runs on AWS (us-east-1). All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Authentication is handled by AWS Cognito with optional MFA (authenticator app). API keys use SHA-256 hashing — plaintext keys are never stored. See our Privacy Policy and Sub-processors page for details on data handling and third-party services.