Security and Data Handling

What we ask you to send

For an evaluation, send a carrier agreement and any recent invoices or billing files available. We do not need system credentials or access to your carrier portal, ERP or TMS.

If you prefer to speak with us before sending the full agreement, you can start with the incentive schedule pages.

Where documents go

Uploaded files go to private storage without a public URL. Your browser receives a confirmation, not an access link. The credential used to read stored documents stays on the server.

Each submission uses a separate dated folder with a random identifier. Uploads cannot overwrite existing files, and files are validated on the server.

Accepted file types: PDF, CSV, XLS, XLSX, DOC, DOCX, TXT, PNG, JPG, JPEG and ZIP. Anything else is refused server side.
Size limits: Up to 10 files per submission, 25 MB per file and 60 MB in total.
Transport: Everything moves over HTTPS. The site is served over HTTPS with no mixed content.
If storage is unavailable: Your inquiry is still recorded if document storage is unavailable. The site tells you that the upload failed so you know the documents need to be sent again.

Who can see it

Only the people working on your engagement can access your documents. We do not use offshore processing or a contractor pool with document access.

We do not share one client's agreement, rates or terms with another client.

At your direction, we share with a carrier only the information needed for a negotiation or claim on your behalf.

What we do not do with it

We do not sell, license or share client data with any third party.
We do not use your rates or terms as a named benchmark for another shipper. Benchmarking is done against aggregate profiles, never an identifiable agreement.
We do not publish client names, logos or figures without written permission. Published case studies describe the mechanism and the profile, not the company.
We do not train any public or third-party model on your documents.
We receive no carrier compensation and do not provide client data to carriers for commercial purposes.

How long we keep it

If an evaluation does not lead to an engagement, we delete the documents after completing the review and sending the written result. During an engagement, we retain agreements and billing data while working for you and afterward as needed to support open claims.

You can request deletion at any time using our contact details. We confirm when deletion is complete. If an open claim requires some records to be retained, we explain that and delete the remaining records.

Services we rely on

The services below handle inquiry or document data. Google Analytics and LinkedIn receive page-view data, not form contents or uploaded documents.

Supabase: Database and private file storage for inquiries, newsletter addresses and uploaded documents.
Resend: Sends the notification of an inquiry to us, and the welcome and unsubscribe emails to newsletter subscribers. Uploaded documents are never attached, so it never handles one.

This website

The site runs Google Analytics so we can see which pages are read. It sets one first-party cookie and sends requests to Google as a page loads. It records the page, a rough location and where you arrived from. It does not store your IP address. It is configured so Google cannot use the data for advertising. And it never receives anything you type into a form or any document you send.

One other Google script runs, and only on the pages with a form: reCAPTCHA, which scores a submission so automated spam does not reach us. It loads when you start filling the form in rather than when the page loads, so reading the site never calls it. Google receives your IP address and how you interacted with the page for that check, and sets a cookie of its own at that point. It does not receive what you typed.

The site also runs the LinkedIn Insight Tag, an advertising tag. It sets cookies and sends LinkedIn the page, your IP address and browser details, so LinkedIn can report which ads led to visits, give us aggregate reports on visitors’ job titles and companies, and let us show LinkedIn ads to past visitors. It never receives anything you type into a form or any document you send.

Beyond those there are no other advertising pixels, no session recording, and no software attempting to identify you individually by name. Fonts are compiled into the site at build time rather than fetched from a font service, so rendering this page does not tell a font provider that you read it.

There is no login, no session and no profile. The only information the site collects about you as a person is what you type into a form and choose to send.

What we do not claim

ebb Logistics does not hold SOC 2, ISO 27001 or an equivalent third-party attestation. Please consider this if your procurement process requires one.