Built defensively. Audited often.
How Druma protects your fleet data, your drivers' personal data, and your carrier relationships — without overselling.
Multi-tenant isolation (RLS)
Every table that holds tenant data is protected by Postgres row-level security policies scoped to user_company_ids(). No application-layer filtering — the database itself refuses cross-company reads. Row-level isolation is covered by a dedicated regression suite and re-verified in every full-stack audit pass.
EU data residency
All data — Postgres, storage, and Edge Functions — is hosted by Supabase in the EU. No transatlantic transfer for operational data. Resend (transactional email) is our one US sub-processor, covered by Standard Contractual Clauses.
JWT + role-based access
Every Edge Function validates the caller's JWT, looks up roles via SECURITY DEFINER RPCs, and enforces company membership. Cron jobs use a separate CRON_SECRET. Webhooks verify HMAC-SHA256 signatures. Generic error responses — no internal detail leaked.
AI: Vertex AI Enterprise (EU)
Smart Import, inbound invoice ingestion, and Ask Druma all use Gemini via Vertex AI Enterprise in europe-west1. Enterprise terms guarantee customer data is never used for model training. AI Disclosure publicly available.
Audit logging
Every state change on orders, invoices, fleet documents, and admin actions is recorded in audit_log with the caller's identity, timestamp, and old/new values. Searchable and filterable in-app, and exportable for your own records.
Error monitoring
Production runtime errors flow through Sentry. Suspicious upload patterns, signup rate limits, and security-sensitive Edge Function failures land in alerts. No tracking pixels — Druma's marketing site explicitly does not run analytics.
Optional 2FA + idle timeout
Per-company TOTP enforcement, configurable session idle timeout (with a 2-minute warning banner before logout), and signup rate limiting. Carrier portal tokens auto-expire after 30 days.
Storage hardening
Every storage bucket has explicit file_size_limit + allowed_mime_types at the database level, plus company-scoped RLS using path-prefix UUID matching. Client-side and server-side MIME validation on every upload helper.
Hardened deploys
Migrations and Edge Functions auto-deploy from main via GitHub Actions — no manual production access. PR validation gates (tsc, vitest, build, i18n lint) must pass before merge. Six full-stack security audit passes completed, most recently August 2026.
Answers to the questions procurement asks
Published so you do not have to send us a spreadsheet to find out. Some of these answers are no — we would rather you learn that here than after signing.
Are you NIS2 compliant?+
There is nothing for us to hold. NIS2 applies to essential and important entities; a transport management system falls in no Annex I or II sector, and Druma is far below the 50-employee / €10M threshold. Any vendor offering you a "NIS2 certificate" is describing something that does not exist. What we do instead is make it easy for you to answer your own supply-chain obligations about us — this page, the DPA, the sub-processor list and our vulnerability disclosure policy are all public, with no NDA. Worth knowing: if you are a haulier, you are very likely out of scope too. The Road subsector covers road authorities and intelligent-transport-system operators, not carriers or freight forwarders. The request usually originates with your shipper, who is in scope.
Where is our data, and does it leave the EU?+
Database, file storage and server functions are hosted in the EU (Ireland). The web front end is served from a global CDN with EU termination. A small number of named recipients sit outside the EEA, each listed in Annex III of our Data Processing Agreement with the personal data it receives and the safeguard that covers it. The core platform, routing and AI recipients are all EU. Our AI processing is pinned to europe-west1 under enterprise terms that exclude training on your data.
Can we force two-factor authentication on everyone?+
Yes, per company, and it is enforced in the database rather than only in the web app — so it holds for direct API access too, not just for someone using the browser. The honest scope: it covers the planner application and privileged server actions. It does not apply to the driver app (drivers sign in with a PIN and have no authenticator flow), to shared portal links, or to API tokens.
Do you hold ISO 27001 or SOC 2?+
No, and we do not claim to. What exists is six internal full-stack security audits, the most recent in August 2026, and a published description of our controls that you can check against this product. Our target is CyberFundamentals Basic — the level Belgium’s Centre for Cybersecurity explicitly recommends organisations require of their suppliers. If a certificate is a hard requirement for you, we will not pass that gate today.
How fast would you tell us about a breach?+
Within 48 hours of becoming aware of a personal-data breach affecting your data, and in any event without undue delay. That is a contractual commitment in the DPA, and our internal runbook works to a tighter 24-hour target. Being straight about the limit: that commitment covers personal-data breaches. An availability or integrity incident with no personal-data element triggers no contractual notice today. Druma is operated by one person and there is no 24/7 on-call rota.
What happens if it all breaks?+
Daily automated backups, retained 7 days. Our documented objectives are a recovery point of 24 hours and a recovery time of 8 working hours, with the procedure, seven scenarios and the known gaps written down and available on request. Two things we will not overstate: a full restore has not yet been rehearsed, so those figures are derived from platform behaviour rather than demonstrated; and backups currently live in the same provider account as production, which is the top item on our own risk register.
Do you support SSO, and is there an SLA?+
No to both, today. Sign-in is by email and password or Google/Microsoft OAuth; there is no SAML or OIDC single sign-on and no domain enforcement. There is also no committed availability percentage — our Terms of Service say so explicitly rather than leaving it implied. If either is a requirement, tell us; neither is a secret and both are on the roadmap rather than in the product.
Reporting a vulnerability
Found something? Email us. There is no bug bounty and no NDA to sign — a good report gets the same response whichever channel it arrives on. Please test against your own account only: Druma is multi-tenant and carries live freight, driver and invoicing data for operating hauliers.
We acknowledge within
3 working days
Initial assessment
10 working days
Fix, high & critical
30 days
Out of scope: our sub-processors’ own infrastructure, findings needing a compromised device, missing hardening headers with no demonstrated impact, scanner output without a proof of concept, and anything that degrades service for real operators. We will not pursue anyone acting in good faith under this policy.
Procurement-ready paperwork
Druma's Data Processing Agreement, Privacy Notice, sub-processor list, and AI Disclosure are publicly available — no NDA required to read what we do with your data.
// SECURITY POSTURE
HOSTING: Supabase EU (Postgres + Storage + EFs)
ISOLATION: Row-level security per company
ENCRYPTION: TLS 1.3 in transit · Supabase-managed at rest
AUTH: JWT (Supabase Auth) · TOTP optional · OAuth Google/Microsoft
AI: Vertex AI Enterprise · europe-west1 · no training opt-in
AUDITS: 6 full-stack passes · latest Aug 2026
SOC 2: Type II planned · not yet certified
STATUS: AUDITED, NOT CERTIFIED