Security
How we protect shipment data
Shipment records contain names, addresses and phone numbers of people who never chose to be our customers — they simply had something sent to them. That shapes how we handle them.
Controls in place today
Passwords are never recoverable
Operator passwords are stored only as PBKDF2-SHA256 hashes with a per-account salt and 100,000 iterations. We cannot tell you your password because we do not have it — we can only reset it.
Sessions expire and can be revoked wholesale
Console sessions are signed tokens in HttpOnly, SameSite cookies that expire after 12 hours. Rotating the signing secret invalidates every session everywhere, immediately.
Tracking lookups are rate limited
A tracking number alone is not enough to open a shipment — the delivery postcode or recipient email is also required. Failed attempts are counted per source and throttled, and a wrong code returns exactly the same response as a number that does not exist, so the endpoint cannot be used to discover valid numbers.
The public page sees less than we do
The tracking page is served from a deliberately reduced projection of a shipment. Recipient email, phone, street address, declared value and internal notes are never sent to the browser, and the recipient name is shortened to a first name and last initial.
Encrypted in transit
All traffic is served over TLS, with HSTS and modern cipher suites terminated at the edge. Plain HTTP is redirected, never served.
Least-privilege data access
Console access is limited to named operator accounts. There is no shared login, and every account is individually revocable.
Operational practice
- Dependencies are pinned and reviewed; security patches are applied on a defined cadence.
- Infrastructure is defined in version control, so every change is reviewable and revertible.
- Rate-limiting records are automatically purged after 24 hours — enforced in code, not policy.
- Backups of shipment data are taken daily and restore procedures are tested.
- Access to production is limited to named staff and reviewed quarterly.
On certifications
We are not going to put badges on this page that we have not earned. Where a formal certification such as SOC 2 or ISO 27001 is in progress rather than complete, we will say so and give you the target date, and we are happy to walk an enterprise security team through our actual controls under NDA.
Current status: [CERTIFICATION STATUS].
Reporting a vulnerability
If you have found a security issue, we want to hear about it before anyone else does. Email security@meridianfreight.com with enough detail to reproduce it.
What we commit to
- Acknowledge your report within two business days.
- Keep you updated while we investigate.
- Credit you when we publish a fix, if you would like that.
- Not pursue legal action for good-faith research.
What we ask
- Give us reasonable time to fix it before disclosing publicly.
- Do not access, modify or delete data that is not yours.
- Do not run denial-of-service or spam tests against production.
- Use a test shipment rather than a real recipient’s record.
See also our Privacy Policy for what we collect and how long we keep it, and our Cookie Policy for browser storage.
Contact our team