Security
Travomate Cargo handles company data, private conversations, and commercial shipping documents. This page consolidates how the platform protects that data (the authentication, access controls, and data protection that sit behind every feature) so it can be reviewed as a single security story.
Authentication
Sign-in is handled through Google Auth (OAuth). The platform never stores a user's Google password; it receives only the profile details the user consents to share: email, name, and profile picture. Because Google has already verified the address, email verification is implicit at signup. See Account & Group Lifecycle.
Sessions are evaluated per request, not cached, so a change to a user's access takes effect immediately. There is no stale-session window in which revoked access still works. This applies uniformly across the platform, including document upload and download links, not just in-app actions.
Authorisation
Access is governed by a whitelist-based permission model: groups explicitly list what they may do, and anything not listed is denied by default. There is no implicit access.
| Control | What it does |
|---|---|
| Group-based permissions | Each group declares exactly which operations it can call; effective permissions are the union of a user's groups |
| Field-level access | Permissions specify which fields a user can read or write on each operation. Unlisted fields are silently hidden |
| Scope-based visibility | Instances are visible only within their scope (own-only, assigned, public, or admin), so users see only what they should |
| State constraints | Some operations are locked by a resource's state (for example, only drafts can be modified) |
The full model, including how instance and field visibility are enforced, is documented in the Users & Access section. See Visibility and Privacy for the enforcement detail.
Data Protection
| Measure | Detail |
|---|---|
| Encryption at rest | Uploaded documents are stored encrypted (see Documents) |
| Conversation confidentiality | Only the participants assigned to a conversation can read it; it is not public and not visible to other users |
| Scoped document access | Documents shared in a conversation are visible only to the parties to that conversation |
| No existence leakage | An instance a user may not see returns a not-found result rather than revealing that it exists |
Admin Access & Moderation
Admin accounts are created manually by the platform (never via self-signup) and are the only accounts that can see all resources regardless of assignment. Admins can:
- Review and action verification submissions
- Moderate listings, reviews, and flagged conversations
- Manage groups and permissions
Every group change is recorded in an audit log with a timestamp and who made it (user, admin, or system). See Account & Group Lifecycle.
Relationship to Privacy
Security is about how access and data are protected; privacy is about what data is held, for how long, and your rights over it. For data retention, GDPR rights, and subprocessors, see Privacy & Data Protection.
On the Horizon
As the platform matures, its formal security posture (for example independent penetration testing, and certifications such as SOC 2 or ISO 27001) will be published here as it is established. Enterprise reviewers who need current documentation can request it through the support channel.
For enterprise procurement
This page is intended as the security overview enterprise cargo owners and forwarders ask for before uploading commercial documents. For the data-handling and GDPR side, pair it with Privacy & Data Protection.