Security at Dispatchly
Dispatchly holds your carrier API keys and your shipment data, so this page sets out exactly what protects them. Everything here describes how the product works today. We do not hold a security certification yet, and we do not claim one.
Read our self-assessment in the CSA STAR RegistryHow We Protect Your Data
What the product does today
Your keys, from your own carrier account
You create each API key in your own carrier account and connect it to Dispatchly. Because the key is yours, you can revoke it at the carrier at any moment without asking us. Deleting a carrier connection in Dispatchly removes the stored key.
Encrypted at rest and in transit
Carrier credentials and two-factor secrets are encrypted with AES-256 before they are stored, and they are stripped from our application logs. Traffic between your browser and Dispatchly is encrypted with TLS.
Sealed handover for your IT team
When the keys sit with IT or a 3PL rather than a Dispatchly user, send them a handover link instead of asking for keys by email or chat. Keys are sealed in the submitter's browser, and the web server that receives them cannot open them. The link also needs a code emailed to the named recipient.
Role-based access
Every member has one of four roles: owner, admin, agent or viewer. Only owners and admins can add or change carrier credentials. Each organization's data is kept separate from every other organization's.
Two-factor sign-in
Every user can turn on app-based two-factor authentication, with recovery codes. Sensitive actions ask for a fresh code even in the middle of a session, whether or not two-factor is turned on.
Security log
Sign-ins, two-factor changes, member and role changes, and every change to a carrier credential are recorded with the IP address and browser used. The log is kept for 540 days (about 18 months), and we share your organization's log on request.
Security & Privacy
Security FAQ
Is Dispatchly SOC 2 or ISO 27001 certified?
No. Dispatchly does not hold SOC 2, ISO 27001 or any other security certification today, and we would rather say so than show a badge we cannot back. This page lists the controls the product actually has. Our answers to the Cloud Security Alliance's security questionnaire (CAIQ) are public in the CSA STAR Registry as a self-assessment: our own account of our controls, not an audit. For a security questionnaire, email security@dispatch.ly.
What does BYOK mean at Dispatchly?
Bring Your Own Key means you create the API key in your own carrier account and give it to Dispatchly, instead of us holding a carrier account on your behalf. We store the key encrypted and use it only to monitor your shipments with that carrier. The encryption key that protects it is ours, not yours: BYOK here refers to your carrier key, not to customer-managed encryption keys. You stay in control because you can revoke the carrier key at any time.
How do we hand over carrier keys if IT holds them?
Send a handover link from Dispatchly to the person who holds the keys. They open it without a Dispatchly login, enter a six-digit code that is emailed to them, and submit the keys one at a time or as a file. The keys are sealed in their browser before they are sent, so the web server that receives them cannot read them. The link expires, and it only works for the recipient it was issued to.
Who in my organization can see our carrier credentials?
Only owners and admins can add, change or remove carrier credentials. Agents and viewers work with parcels and tickets but cannot manage credentials. Every change to a credential is written to the security log.
What is logged, and for how long?
We log sign-ins, two-factor changes, member and role changes, changes to carrier credentials and webhooks, and subscription changes, each with the IP address and browser used. These records are kept for 540 days (about 18 months), including after an organization is deleted, and are then deleted automatically.
Can I export or delete our data?
Yes. An owner can request an export of the organization's data from Settings; the export file is deleted 7 days after it is created. An owner can also delete the organization. Deletion takes effect 30 days later and can be cancelled until then. The privacy policy lists every retention period.
Responsible Disclosure
Found a security vulnerability? We take responsible disclosure seriously. Please report any issues to security@dispatch.ly and we will respond within 48 hours.