How CargoLens protects your inspection records

What CargoLens is

• Software only: a mobile app for iPhone and Android phones and tablets, and a web portal for managers and reporting. Nothing is installed on your network.

Hosting and region

• Database, sign-in, file storage and server functions run on Supabase, hosted on AWS in us-east-1 (N. Virginia). The web portal and this website are hosted on Vercel. Customer data is stored in the United States.
• All traffic is encrypted in transit with HTTPS/TLS. Data at rest is protected by the hosting platform’s managed storage encryption.
• Automated daily database backups, retained for 7 days.
• CargoLens does not hold its own SOC 2 report. Our database and storage run on Supabase and AWS, which hold SOC 2 Type 2 reports.

Isolation and access

• Each customer is its own organization. Row-level security is enforced in the database on every application table, so a user can only read and write their own organization’s records.
• Photos and signatures are kept in private storage. In the app, the portal, PDFs and exports, each view uses a signed link that expires within one hour. Photo links in the optional weekly plant report email expire after 7 days.
• Four roles: Admin (users, sites, forms), Manager (review, follow-ups, reports, exports), Receiver (records loads, photos, signatures) and Viewer (read-only). Users can be limited to a single site.
• Separation of duties is enforced in the database: receivers cannot approve, reject or resolve loads, cannot change the evidence on an approved load, and can only complete follow-up tasks assigned to them. Role changes need an Admin, and the last Admin of an organization cannot be removed.
• Sign-in is by email and password. Deactivated users lose access, and their past records stay intact.
• CargoLens support access to customer data is limited to the founder, for support you request.

Record integrity

• Offline capture is durable: records and photos captured without signal stay on the device until the server confirms each upload.
• Shared tablets: queued records keep the receiver who captured them, and the server records who uploaded them.
• Each record keeps the exact version of the form it was captured on, so later edits to a form do not change past records.

Your data

• You own your data. We keep rights only in the software.
• Export at any time to Excel, CSV and PDF, at no charge.
• After a subscription ends, your data stays available for export for 30 days and is then deleted within 30 days, or sooner on written request.

AI and your data

• CargoLens uses Anthropic Claude for its optional AI features: suggesting damage and a damage category from an inspection photo, reading shipping paperwork to suggest fields, and drafting inspection forms from text an admin types. The receiver confirms or changes each suggestion.
• Anthropic processes this data under its commercial API terms, which do not allow it to train models on customer content. We do not train models on your data.
• Each user is asked for consent in the app before first use. AI can be switched off for your organization on request; capture works fully without it.

Subprocessors

We notify customers by email before adding a subprocessor. See also our privacy policy.

Incidents and contact

We notify affected customers without undue delay, and within 72 hours, after confirming a security incident affecting their data. Security contact: Founder & CEO, ryan@cargolens.app, (503) 974-6330.