Trust & Security
How Numeo secures your data across Numeo Spot, Numeo One, and our AI services — managed databases on Google Cloud, encryption everywhere, layered access controls, and clear limits on how your data is used.
Enterprise Security
Our security approach
Numeo powers dispatch, communications, accounting, and fleet operations for carriers, brokers, and dispatchers who work with sensitive operational and financial data every day. Security is built into how we design, build, and run the platform — across Numeo Spot, Numeo One, and our AI services.
At a high level, we focus on:
- Enterprise-grade cloud infrastructure on Google Cloud.
- Encryption of data in transit and at rest.
- Layered network and access controls, with least-privilege access and continuous monitoring.
- Clear limits on what data we use and why.
Infrastructure and hosting
Numeo runs on Google Cloud, using managed, security-hardened infrastructure so we can focus on protecting your data rather than patching servers.
- Hosted on Google Cloud, with managed patching and infrastructure maintained by Google.
- Customer data encrypted at rest with AES-256.
- All connections encrypted in transit.
- Continuous security monitoring, logging, and alerting across production.
How and where we store your data
Everything you see in Numeo — your account, your loads, your drivers, your emails — lives in managed, security-hardened databases on Google Cloud.
- Email content (the messages Numeo reads to power features like rate-confirmation capture and AI replies) is stored in a managed PostgreSQL database on Google Cloud.
- Account and operational data (users, companies, loads, drivers, brokers) is stored in MongoDB Atlas, MongoDB’s managed and independently audited cloud service.
- Payment card data never touches our servers. All payments are processed by Stripe, a PCI-DSS Level 1 certified provider. We store only your subscription status — never card numbers.
Both databases encrypt all data at rest with AES-256, and every connection to them — including from our own services — is encrypted in transit.
Why your data is safe: layers, not a single lock
No single safeguard protects your data — several independent layers do, and an attacker would need to defeat all of them at once:
Layer 1 — Our databases are not reachable from the internet.
They only accept connections from approved network locations: our production services and a small, fixed set of approved addresses. If anyone else tries to connect — even with a valid username and password — the connection is refused before a password is ever checked.
Layer 2 — Credentials live in a vault, not in code.
Database passwords and connection details are never written into our source code. They are kept in Google Secret Manager, Google Cloud’s encrypted secrets vault, and delivered to our services only at deployment. Even if our entire source code leaked, it would contain no way in — and even if a credential somehow leaked, Layer 1 still blocks the connection from any unapproved location.
Layer 3 — Access is least-privilege and personal.
Production access is granted per person, by an administrator, with the minimum permissions needed. Nobody at Numeo has standing access to customer data “just in case,” and access is logged and monitored.
Layer 4 — Your password can't be read, even by us.
We never store your password. We store only a salted one-way cryptographic hash, which cannot be reversed back into your password — not by an attacker, and not by us.
How Numeo connects to your email
When you connect Gmail or Outlook, Numeo uses the provider’s standard OAuth flow:
- You log in on Google or Microsoft, not inside Numeo.
- Google or Microsoft ask you to approve the requested permissions.
- If you agree, they issue secure tokens that let Numeo send and read email only in the scopes you approved — without sharing your password.
We never see or store your email password. Access tokens are stored securely and can be revoked at any time — disconnect from your provider or your Numeo settings and we revoke our access.
What data we access (and why)
To power features like 1-Click Emails, AI Emails, rate-confirmation capture, follow-ups, and booking history, Numeo needs limited access to your email:
- Send emails to brokers from your connected account, at your direction.
- Read emails related to loads and brokers so we can:
- Extract load and rate-confirmation details.
- Match replies to loads.
- Build your recent booking history.
Under Google’s Limited Use requirements, which we commit to in our Privacy Policy, your email data may not be used for advertising, sold, read by humans outside narrow consented cases, or used to train AI models.
SOC 2 and compliance
Numeo maintains SOC 2 Type IIcertification. Our SOC 2 Type II audit independently verifies that the controls described on this page — access management, monitoring, encryption, and secure development — exist and operate.
Our program emphasizes:
- Access control and least-privilege access.
- Monitoring and logging of system activity.
- Secure development and change management.
Our cloud provider and other subprocessors are also independently audited against SOC 2 Type II and similar frameworks; our email infrastructure provider is ISO 27001 certified. Customers and their compliance teams can request our SOC 2 Type II report under NDA — contact support@numeo.ai.
Subprocessors and AI providers
Numeo works with a limited set of vetted subprocessors to deliver the platform:
- Cloud hosting and databases (Google Cloud, MongoDB Atlas) and payments (Stripe).
- Email and calendar connectivity for the providers you connect (Google, Microsoft).
- Enterprise AI providers — Microsoft Azure OpenAI, OpenAI, Google (Vertex AI / Gemini), and Anthropic.
AI providers process your data only to deliver the features you request, under enterprise terms that prohibit using it to train their models. We do not sell your data or use it for advertising. A current list of subprocessors is available on request, and our Privacy Policy details how Google user data is handled under Google’s Limited Use requirements.
If you have security questions
If you have any questions about security, data protection, or compliance:
- Contact us at support@numeo.ai.
- Or reach out through the in-app support widget.
We’re happy to coordinate with your IT or compliance team.
Your data lives in managed databases on Google Cloud — PostgreSQL for email content, MongoDB Atlas for account and operational data — encrypted at rest with AES-256 and reachable only from approved network locations. Numeo maintains SOC 2 Type II certification; our email infrastructure provider is additionally ISO 27001 certified. Email connects via OAuth 2.0 for Gmail and Outlook, so Numeo never sees or stores your email password; access tokens are stored securely and revocable anytime, and access follows least-privilege controls with monitoring and logging.
Your data is stored in managed databases on Google Cloud — PostgreSQL for email content, MongoDB Atlas for account and operational data — encrypted at rest with AES-256. Those databases are not reachable from the public internet: they accept connections only from our production systems and a fixed set of approved addresses. Inside Numeo, access is granted per person, with least-privilege permissions, and is logged. In practice, the only thing reading your data day-to-day is the product itself, doing what you asked it to do.
Several independent layers, each of which must fail before any data is exposed. A stolen database password alone gets an attacker nothing, because our databases refuse connections from unapproved network locations. Stealing our source code gets them nothing, because credentials aren't in the code — they live in Google Secret Manager, an encrypted vault. Even someone holding a full connection string would still be stopped at the network layer. On top of that, the data itself is encrypted at rest, every connection is encrypted in transit, and your login password exists only as an irreversible salted hash.
Yes — follow the life of one email. When a broker replies to you, Numeo receives it over an encrypted connection using the scoped permission you granted when you connected your inbox (we never see or store your email password). The message is stored in a database that is encrypted at rest and unreachable from the public internet. Under Google's Limited Use requirements, which we commit to in our Privacy Policy, that email may not be used for advertising, sold, read by humans outside narrow consented cases, or used to train AI models. And our SOC 2 Type II audit independently verifies these controls exist and operate — customers can request the report under NDA at support@numeo.ai.
Scope is deliberately limited: Numeo sends broker emails from your connected account and reads load- and broker-related emails to power booking history and reply matching. That data is never used for advertising, never resold, and never shared with third parties. You can disconnect and revoke access at any time.
Yes — Numeo maintains SOC 2 Type II certification, and our email infrastructure provider is additionally ISO 27001 certified. Our SOC 2 Type II audit independently verifies our security controls; qualified buyers can request the report under NDA at support@numeo.ai.
Good questions to cover: how credentials are handled (OAuth, no stored passwords), what email scope is granted, how access is logged and revoked, what data is retained, and which compliance attestations apply (Numeo holds SOC 2 Type II; our email infrastructure provider is ISO 27001 certified). Numeo's security team can walk through each.
Operations leaders, IT/security, and compliance staff — anyone responsible for systems that touch dispatch, broker communication, documents, or customer commitments. Because Numeo connects to email and load boards, a quick security review up front keeps adoption smooth.