Security

Nerivo reads your fleet’s data from the systems you already run. This page says plainly how that data is protected. Questions go to security@nerivo.io.

Access to your systems

• Read-only. We connect to your ELD, fuel card, toll and TMS providers with the least access they offer, and we never write to them. We recommend creating a dedicated read-only user for Nerivo where the provider supports it; our setup notes say how.
• Credentials are encrypted. API keys and logins you give us are encrypted at rest with a key that lives only in our hosting environment, not in the database or the code. They are never shown again in the app and are not available to the AI assistant.
• You can disconnect at any time from Settings. Data already read stays until you delete it or close the account.

Keeping companies apart

• Every record carries the company it belongs to, and every request to the Service is limited to the company of the logged-in user. Our automated tests check this on every API endpoint.
• Neri reads data through a separate database role that can only read, and that the database itself limits to one company at a time (row-level security). It cannot see credentials, logins or other companies.

Infrastructure

• The Service runs on Railway and Vercel in the United States, on infrastructure that is encrypted at rest. All traffic uses TLS (HTTPS); plain HTTP is redirected and browsers are told to use HTTPS only (HSTS).
• Email is sent through Resend from a verified Nerivo domain with SPF, DKIM and DMARC.
• Backups are automatic and encrypted; they are used for recovery, not for any other purpose.

Accounts

• Invitation-only accounts; no public sign-up. Owners and admins control who is on the team and what role they have.
• Passwords are stored hashed, must be at least 10 characters, and repeated failed logins lock the account for 15 minutes. Password reset links work once and expire in an hour.
• Session cookies are secure, HTTP-only and bound to the app’s domain; every change goes through CSRF protection.

People and process

• Access to production systems is limited to the people who run the Service, with individual logins and two-factor authentication.
• Dependencies are audited for known vulnerabilities and updated. Secrets are never committed to source code.
• If we learn of a security incident affecting your data, we will tell you without undue delay, with what happened and what we are doing about it.

Reporting a vulnerability

If you find a security problem in Nerivo, email security@nerivo.io. We will acknowledge within two business days and keep you informed. Please do not access data that is not yours or disrupt the Service while testing.