Security

Built for the questions hospitals and labs ask

Hospital and lab buyers ask how specimen runs, patient addresses, and signatures are protected before they sign. Here is how RouteCheetah works, in plain terms.

Your data is walled off by the database

Every record belongs to one company, and PostgreSQL row-level security refuses to return another company's rows, even if a screen or report asks for them by mistake. The API connects as a database role those rules apply to, and every request works inside a single company.

Encrypted in transit, secrets protected at rest

Everything between your devices and RouteCheetah (the app, the API, and tracking links) travels over HTTPS (TLS).
Passwords are stored only as salted scrypt hashes. Nobody at RouteCheetah can read them.
Sign-in tokens, API keys, and invitation links are stored only as hashes.
Two-factor secrets are encrypted with AES-256-GCM under a key kept outside the database, and backup codes are stored as keyed hashes.

Two-factor sign-in

Anyone can turn on sign-in codes from an authenticator app on their phone, with ten single-use backup codes.
Owners can require two-factor sign-in for everyone in the company. Anyone who hasn't set it up is asked to before they can see anything.
Each code works once, and five wrong codes in a row pause sign-in for 15 minutes. Password attempts are rate-limited too.

An audit log you can export

Owners and admins see who did what and when, with the IP address and device:

Sign-ins and failed attempts, two-factor changes, and devices signed out
Invitations, role changes, and people whose access was turned off
Rate card, driver pay, and customer rate changes, and repriced orders
Settings changes, and API keys created or revoked
Invoices sent, paid, or voided, and CSV exports of reports and the log itself
Canceled orders, deleted routes and standing orders, and removed places

Entries are written by the code that makes each change, and the database refuses to edit or delete them afterward. Filter the log and export it to CSV.

Everyone sees only what their role needs

Owners and admins manage settings, the team, pricing, and invoices; only owners manage billing.
Dispatchers plan and dispatch routes. They see prices but not driver pay or margins.
Drivers see only their own routes and stops.
Customers see only their own orders in the ordering portal.
API keys can't do more than a dispatcher, and can be revoked at any time.

Sessions you control

Everyone can see the devices signed in to their account, with the IP address and when each was last active.
Sign out one device or all the others; it loses access immediately.
Sign-in tokens last 15 minutes and are renewed in the background. A stolen renewal token that's used twice signs that person out everywhere.
Turning off someone's access to your company takes effect on their next request.

Where your data lives

RouteCheetah keeps your company's data in two places with our cloud hosting providers: a managed PostgreSQL database (orders, stops, routes, people, prices, and the audit log) and a private file storage bucket (signature images and delivery photos). Files are never public. The app shows them through links that expire within an hour.

Driver location is recorded only while a route is in progress, and detailed location history is deleted automatically after 90 days.

Some features send data to other services to do their job: maps and address lookup, route planning with live traffic, the email and text-message providers that send the updates you turn on, push notifications, Stripe for subscription billing, and, only when someone uses the AI assistant, Cloudflare Workers AI to read the message or photo they submitted. Ask us for the current list of hosting providers, regions, and subprocessors.

Business Associate Agreements (BAA)

A BAA is available on request. If you'll be handling protected health information, such as patient names or medical record numbers on labels, email [email protected] before you start and we'll send ours for review.

Report a security issue

If you believe you've found a vulnerability, email [email protected] with the details. Please don't access other people's data or disrupt the service while testing.

Security questions

Can another courier company ever see our data?

No. Every company's orders, routes, people, prices, and audit log are tagged with the company they belong to, and the database itself refuses to return another company's rows (PostgreSQL row-level security). RouteCheetah connects to the database with a role those rules apply to, so a mistake in a single screen or report still can't show you anyone else's data.

Do you sign a Business Associate Agreement (BAA)?

A BAA is available on request. If your deliveries will carry protected health information, such as patient names on specimen labels, email [email protected] before you start and we'll send ours for review.

What happens when someone leaves our company?

An owner or admin turns off their access on the Team page and they lose access to your company right away. Their past work stays in your records and audit log under their name.

Can our people use their phones for two-factor sign-in?

Yes. Any authenticator app works: Google Authenticator, Microsoft Authenticator, 1Password, Authy, and others. Each person also gets ten single-use backup codes for when a phone is lost or replaced.

Where are signatures and delivery photos stored?

In private file storage that is never publicly readable. The app shows a photo or signature through a link that stops working within an hour, and only to people in your company who can see that delivery.

See it for yourself

Start a 14-day free trial, turn on two-factor sign-in, and watch the audit log fill in. No credit card required.

I'm a driver I manage drivers