Security

Signing in

• Passwords aren't stored. Only a one-way scrambled form is kept, made with scrypt and a random salt for each password. A password is 10 to 200 characters, with no rules about symbols.
• Sign-ins are random codes. The code sits in a cookie that page scripts can't read, sent only over HTTPS. Only its fingerprint is stored, so a copy of the database can't sign anyone in. A sign-in ends after 14 days without a visit.
• Guessing is slowed down. At most 20 sign-in tries a minute from one address, and 8 a minute for one email.
• A new password signs you out elsewhere. Changing or resetting it signs out every other device.
• Continue with Google. The server checks Google's signature on each sign-in. RouteMojo never sees your Google password.

Every connection is encrypted

• HTTPS everywhere. RouteMojo's server sits behind Caddy, which gets and renews its HTTPS certificate by itself and sends plain HTTP on to HTTPS. Browsers are told to use HTTPS for this address for a year.
• Strict pages. Pages run scripts only from RouteMojo itself, can't be shown inside another site's frame, and don't pass drivers' or customers' links on to other sites.
• Changes from other sites are refused. A change sent from another website, while you're signed in here, is turned away.

Your team's data stays yours

• Each team sees only its own. Every request is checked against the team of whoever is signed in. Another team's routes answer "not found".
• Owners and dispatchers. Dispatchers plan and send routes, and see what the plan allows. Only owners change the plan, see payments and change who is on the team, and the server checks it on every request.
• Undo stays in your team. Undo keeps and puts back your team's own changes, never another team's.

Drivers' and customers' links

• A driver's link opens one route. The server signs it, and it works for that route only. Stop sharing it at any time, or make a new link so the old one never works again. It stops working two days after the route's day.
• A tracking page shows one delivery. The business's name, the day, the address and how it's going. While the driver is heading there, a small map shows where they are; once it's delivered, the photos and signature, unless you turn them off. Never the driver's name, a phone number, a note or another stop. It ends 7 days after the delivery day.
• A proof page shows the routes you pick. It's read-only: each stop's time, photos, signature and where it was marked, and the driver's path from the first stop to the last. Names only if you turn them on, and never phone numbers or notes. It ends after 90 days, or when you stop sharing it.
• Links stay private. The app keeps them out of its logs, out of search engines, and out of what a browser tells the next site. Made-up links are limited per address.

Drivers' locations

• The driver chooses. Sharing location is off until the driver turns it on, and works only while their route's page is open.
• Kept 30 days. Drivers' location points are deleted after 30 days.
• Where a stop was marked stays. It's kept with the stop as proof of delivery, for as long as your team keeps its days.

Payments

• Card details go to Stripe. You pay on Stripe's own page, and change your card or cancel on Stripe's billing page. Card numbers never reach RouteMojo's server, so they're never stored there.
• Stripe's messages are checked. Each message from Stripe has to carry Stripe's signature, or it's refused.

Backups

• Every night. A copy of the database, the server's secret key and the proof photos.
• The last 14 are kept. Each time a new copy is made, the oldest goes.
• On the same server. The copies stay on RouteMojo's own server, not in a second place. They guard against mistakes and a damaged database, not against losing the server.

The age of the last backup is on the status page.

Logs

• Small. Each part of the server keeps at most 50 MB of logs, then the oldest go.
• No stop locations. The road server never writes the places it's asked about to a log.
• No links. The app doesn't log each request, so drivers', customers' and proof links stay out of its logs.

Export and delete

• Export any day. Each day's stops and what happened at each, as Excel or CSV, in your own columns. Proof of delivery exports too: when each stop was done, how many photos it has, who signed, and where it was marked, with a link to its photo in the Excel file. Cells that look like formulas can't run.
• Delete what you put in. Delete stops and remove routes until a driver has marked them, take back an import, stop a driver's link or a proof page, and remove people from your team. Undo can bring a deleted stop back. What a driver marked stays, as the record of the day.
• Delete your team. Write to us and we delete the team, its accounts, days, stops, drivers and photos within 30 days. Copies in backups made before then go as newer backups replace them, within about two weeks.

Removing a driver hides them from new days. Past days still say who drove them. What we keep, and why, is in the privacy policy.

Not done yet

• Two-factor sign-in. A password, or Google where it's on, is all a sign-in takes.
• An outside review. No independent security review or penetration test has been done.
• Backups in a second place. They're kept on the same server.
• Encrypting the database file. The app doesn't encrypt its database on the disk.
• Certifications. RouteMojo holds none, such as SOC 2 or ISO 27001.

Report a problem

Found a security problem? Email support@routemojo.com with what you found and how to see it again. Please don't open other teams' data or slow the service down while you look. The same address is in security.txt.