Your shipments move fast. Your data moves secured.
95 Logistics invests in the security infrastructure most small logistics companies don't. Encryption in transit and at rest, automated admin session auditing, real-time credential-theft detection, and disaster-proof backups — all running in the background so you can focus on your shipment.
Uptime target
99.9%
Encryption
TLS 1.3
Backup frequency
DAILY
Payment security
PCI-DSS
How we protect you
Six security pillars, audited continuously.
Encryption
All customer-facing and admin traffic runs over TLS 1.3. Database connections use encrypted MongoDB channels. Passwords hashed with bcrypt (work factor 12, rotated keys).
Admin session auditing
Every authenticated admin request is fingerprinted — browser, OS, device type, IP — with a rolling history of the last 20 sessions per staff member. Any change is visible to senior admins in real time.
Automated incident response
When two consecutive admin sign-ins come from different countries within a short window, the system automatically revokes the session and alerts every admin. Credential theft is contained in seconds, not days.
Strict password policies
Admins: 12+ chars with upper/lower/number/symbol. Mandatory 120-day rotation. Brute-force lockout after 5 failed attempts. One-click "force logout all sessions" for instant incident response.
Backups & disaster recovery
Encrypted database snapshots run nightly and are replicated to off-site S3 storage. 30-day retention. Tested restore procedure with point-in-time recovery. Admins get a status email on every backup.
PCI-DSS payments
Card data never touches our servers. All payments flow through Stripe's PCI-DSS Level 1 certified processor via tokenization. We store only the last 4 digits and an opaque token.
The details
Specific controls in production today.
Verbatim from our production system. If a control is listed here, it's live — not a slide in a deck.
Separate admin & customer authentication
Admin sessions and customer sessions use independent JWT secrets and cookie namespaces. A compromised customer account cannot see admin data.
Token-version revocation (no Redis dependency)
Every admin JWT carries a token_version claim. Force-logout or auto-revoke increments the claim → all existing tokens (access + refresh) fail on next request.
Impossible-travel detection
Sign-ins from different countries within 60 minutes trigger automatic session revocation and admin-wide email alert. Private/reserved IPs skipped to avoid false positives.
Device fingerprint history
Last 20 admin sessions per staff member with User-Agent parser output: browser, OS, device type, IP, timestamp. Surfaced in the admin panel for senior review.
Password rotation & strength policy
Admins forced to change passwords every 120 days. bcrypt hashing with work factor 12. Reset tokens are single-use, expire in 1 hour, and rate-limited per IP.
Audit log for all financial changes
Every change to markup, zone rates, discounts, or airline freight is logged with the admin's identity, the previous & new values, and an optional reason.
Encrypted off-site backups
Nightly gzipped JSON dump of every non-excluded MongoDB collection, encrypted and replicated to S3. Backup history visible in admin panel with status, size, and duration.
Real-time anomaly detection on funnel metrics
Statistical outliers in quote conversion, payment success rate, or user velocity automatically alert admins. Separates 'the data is weird' from 'something is broken'.
Found something concerning?
We take security reports seriously. Email us with details of any vulnerability, misconfiguration, or privacy concern and we'll acknowledge within 24 hours. Researchers who follow responsible disclosure get public credit (with permission).
security@95logistic.comAlways monitoring
20+ background services run 24/7: anomaly detection, CTR monitoring, abandoned-cart recovery, backup verification.
< 60s incident response
Impossible-travel detection typically revokes a compromised session within one authenticated request of the suspicious sign-in.
US-based infrastructure
All data stored in US data centers with encrypted off-site replication. Compliant with US privacy regulations for Bahamas-bound commerce.
Last reviewed
June 2026