Security

1Our Position

Flower Freight holds transport compliance records for licensed New Jersey cannabis operators. That data is commercially sensitive and, in the case of Metrc-derived records, contractually confidential under our signed NJ CRC Confidentiality and API User Agreement.

This page describes what we actually do, not what we intend to do. Where a control is planned rather than in place, it says so.

2Encryption

• In transit. All traffic uses TLS 1.2 or higher. HTTP Strict Transport Security is enforced with a one-year max-age and subdomain inclusion.
• At rest. Database and file storage are encrypted at rest by our infrastructure provider using AES-256.
• Credentials. Metrc API keys are stored server-side only, not returned to browsers after submission, and never included in logs, exports, or error messages.

Encryption is one part of our security controls; contractual compliance also depends on operational practices.

3Access Control

Between operators. Every table holding operator data enforces row-level security in the database itself. Policies scope access by company, role and authorized transport participation. Server-side workflows additionally enforce authorization; these controls reduce risk but do not guarantee that software is free of vulnerabilities.

Within an operator. Driver accounts are scoped to their own assignments. A driver cannot view the load board, rates, other operators, other drivers, or any account or billing information.

API authentication. Every endpoint that reads or writes operator data validates a signed session token server-side and derives identity from that token. Client-supplied identifiers require authorization; tracking links use revocable access tokens.

Administrative access. Production database and infrastructure access is limited to Flower Freight personnel who require it for operations or support — currently a single named individual. Privileged sign-ins prompt for multi-factor authentication; the privacy-review API requires a verified second factor. Administrative events are recorded where supported by the application and providers.

Secrets. Credentials are held in environment variables scoped per environment, never committed to source control. Keys are rotated on personnel change or suspected exposure.

4Incident Response

These are contractual commitments under our NJ CRC API User Agreement, not aspirations. The clocks start when we become aware.

Notification includes what happened, what data was involved, what we have done, and what you should do. We do not delay notification to complete an investigation.

To report a suspected vulnerability or incident, email security@flowerfreight.app. We acknowledge within one business day. We will not pursue legal action against good-faith security research that does not access other operators' data or degrade service.

5Data Handling

Payments. Flower Freight never holds, processes, or transmits funds for freight. Subscription billing runs through Stripe; card data goes directly to Stripe and never reaches our servers. We store no bank account or routing numbers.

Minimization. Separate driver forms minimize identifiers where possible, but uploaded evidence can contain full identity-document details. We record driver location only during an active transport, never between runs.

Portability. Company owners can download structured records at Account, billing & data; uploaded documents and additional personal information can be requested through support. There is no export fee and no notice period.

Deletion. Retention periods and the deletion schedule are set out in our Privacy Policy, Section 7.

6Infrastructure and Subprocessors

Flower Freight runs on managed infrastructure. We do not operate physical servers. Our primary database is in the United States; provider infrastructure and support may process information internationally.

The complete subprocessor list, with the data each receives, is in our Privacy Policy, Section 6.

7Application Security

• Content Security Policy restricting script, style, and connection sources
• Clickjacking protection via X-Frame-Options and frame-ancestors
• MIME-type sniffing disabled
• Referrer policy limiting cross-origin leakage
• Webhook endpoints verify HMAC signatures and reject unsigned requests
• Dependencies reviewed for known vulnerabilities before release

8What We Ask of You

• Use a unique, strong password. Do not reuse one from another system.
• Remove drivers from your account the day they leave. Revoke their memberships and active sessions as appropriate.
• Generate your own Metrc API key. Never use another company's, and never share yours — keys are non-transferable under the CRC agreement.
• Rotate your Metrc key if you suspect exposure, and update it in Account → Metrc.
• Tell us at security@flowerfreight.app if you see anything that looks wrong. A false alarm costs nothing.