Security

1Our Position

Flower Freight holds transport compliance records for licensed New Jersey cannabis operators. That data is commercially sensitive and, in the case of Metrc-derived records, contractually confidential under our signed NJ CRC Confidentiality and API User Agreement.

This page describes what we actually do, not what we intend to do. Where a control is planned rather than in place, it says so.

2Encryption

• In transit. All traffic uses TLS 1.2 or higher. HTTP Strict Transport Security is enforced with a two-year max-age and subdomain inclusion.
• At rest. Database and file storage are encrypted at rest by our infrastructure provider using AES-256.
• Credentials. Metrc API keys are stored server-side only, never transmitted to browsers, and never included in logs, exports, or error messages.

This satisfies the encryption obligations in Section 9 of the NJ CRC API User Agreement.

3Access Control

Between operators. Every table holding operator data enforces row-level security in the database itself. An operator's session can only read rows belonging to that operator. This is enforced at the data layer, not in application code, so a bug in a page cannot expose another company's records.

Within an operator. Driver accounts are scoped to their own assignments. A driver cannot view the load board, rates, other operators, other drivers, or any account or billing information.

API authentication. Every endpoint that reads or writes operator data validates a signed session token server-side and derives identity from that token. Client-supplied identifiers are never trusted.

Administrative access. Production database and infrastructure access is limited to Flower Freight personnel who require it for operations or support — currently a single named individual. Access requires multi-factor authentication. Administrative actions are logged.

Secrets. Credentials are held in environment variables scoped per environment, never committed to source control. Keys are rotated on personnel change or suspected exposure.

4Incident Response

These are contractual commitments under our NJ CRC API User Agreement, not aspirations. The clocks start when we become aware.

Notification includes what happened, what data was involved, what we have done, and what you should do. We do not delay notification to complete an investigation.

To report a suspected vulnerability or incident, email security@flowerfreight.app. We acknowledge within one business day. We will not pursue legal action against good-faith security research that does not access other operators' data or degrade service.

5Data Handling

Payments. Flower Freight never holds, processes, or transmits funds for freight. Subscription billing runs through Stripe; card data goes directly to Stripe and never reaches our servers. We store no bank account or routing numbers.

Minimization. We store the last four digits of a driver's license, never the full number. We record driver location only during an active transport, never between runs.

Portability. Every operator can export their complete record at any time from Account → Data. There is no export fee and no notice period.

Deletion. Retention periods and the deletion schedule are set out in our Privacy Policy, Section 7.

6Infrastructure and Subprocessors

Flower Freight runs on managed infrastructure. We do not operate physical servers. All processing occurs in the United States.

The complete subprocessor list, with the data each receives, is in our Privacy Policy, Section 6.

7Application Security

• Content Security Policy restricting script, style, and connection sources
• Clickjacking protection via X-Frame-Options and frame-ancestors
• MIME-type sniffing disabled
• Referrer policy limiting cross-origin leakage
• Webhook endpoints verify HMAC signatures and reject unsigned requests
• Dependencies reviewed for known vulnerabilities before release

8What We Ask of You

• Use a unique, strong password. Do not reuse one from another system.
• Remove drivers from your account the day they leave. Their access ends immediately.
• Generate your own Metrc API key. Never use another company's, and never share yours — keys are non-transferable under the CRC agreement.
• Rotate your Metrc key if you suspect exposure, and update it in Account → Metrc.
• Tell us at security@flowerfreight.app if you see anything that looks wrong. A false alarm costs nothing.