Security

Last updated: March 26, 2026

WardenIQ is built for freight brokerages that handle sensitive pricing, customer, and carrier data. Security is foundational to our architecture, not an afterthought.

Infrastructure

Data Protection

• Passwords are hashed using bcrypt with per-user salts. We never store plaintext passwords.
• Email credentials (SMTP/IMAP passwords, OAuth tokens) are encrypted at rest using Fernet symmetric encryption with a key stored outside the database.
• Database backups are encrypted and retained for disaster recovery.
• Session tokens use signed JWTs with expiration. Tokens are not stored server-side and cannot be forged without the signing key.

Outlook Add-in Security

The WardenIQ Outlook Add-in requests the ReadItem permission level — the lowest available for mail add-ins. This means:

• Can read the subject, body, sender, and recipients of the email you are currently viewing.
• Cannot access other emails in your inbox, your calendar, contacts, or any other mailbox data.
• Can compose a pre-filled reply when you click "Reply with Quote" — but you review and send it yourself in Outlook. The add-in cannot send emails on your behalf.
• Cannot modify or delete any existing mailbox content.

When you click "Quote This," the add-in sends the current email's content to WardenIQ servers for parsing. Here's what happens with that data:

• The email body is processed by our AI parser to extract lanes, equipment, dates, and rates.
• Extracted structured data (lanes, rates, customer info) is stored in your tenant's encrypted database.
• Raw email bodies are not stored after parsing is complete.
• No data is sent until you explicitly interact with the add-in — it does not run in the background or transmit data automatically.

AI & Data Processing

• Email parsing: AI models extract structured freight data from unstructured email text. The AI provider does not retain your data after processing, and your data is not used to train models.
• Win probability: A locally-trained machine learning model runs entirely on our servers. No customer data leaves our infrastructure for this feature.
• Lane scoring: A proprietary scoring engine analyzes your quote history across four dimensions (balance, consistency, momentum, timing) to score every lane. Scores are computed from your own account data only, cached server-side for up to 15 minutes per tenant, and invalidated when outcomes change. When city-level data is insufficient, the engine aggregates to market, state, or regional level using only your own data. No cross-tenant data is used in individual scores.
• WIQ Network: Anonymized, aggregated market trends. Individual quotes, customer names, and rates are never shared across tenants.

Access Controls

Feature	Admin	Member
View own quotes & lanes	Yes	Yes
View team quotes	Yes	Own team only
Manage users & roles	Yes	No
View all teams' data	Yes	No
Billing & subscription	Yes	No

Incident Response

In the event of a security incident affecting customer data, we will notify affected customers within 72 hours via email with details of the incident, data affected, and remediation steps taken.

Responsible Disclosure

If you discover a security vulnerability, please report it to [email protected]. We take all reports seriously and will respond within 48 hours.

Questions

For security-related questions, contact [email protected]. For general support, visit our support page.