Built defensively. Audited often.
How Druma protects your fleet data, your drivers' personal data, and your carrier relationships — without overselling.
Multi-tenant isolation (RLS)
Every table that holds tenant data is protected by Postgres row-level security policies scoped to user_company_ids(). No application-layer filtering — the database itself refuses cross-company reads. Row-level isolation is covered by a dedicated regression suite and re-verified in every full-stack audit pass.
EU-hosted database and storage
The database, file storage and server functions are hosted by Supabase in the EU (Ireland). Several named recipients may process data outside the EEA — for example Resend (transactional email) and Cloudflare (CDN) — each with its safeguard listed in the sub-processor list. AI requests are processed on Google Vertex AI's EU multi-region endpoint, with one exception: optional web research for company and site enrichment (see the AI Disclosure).
JWT + role-based access
Every Edge Function validates the caller's JWT, looks up roles via SECURITY DEFINER RPCs, and enforces company membership. Cron jobs use a separate CRON_SECRET. Webhooks verify HMAC-SHA256 signatures. Generic error responses — no internal detail leaked.
AI: Google Vertex AI (EU multi-region endpoint)
Smart Import, inbound invoice ingestion, and Ask Druma all use Gemini via Google Vertex AI on Google's EU multi-region endpoint, where, according to Google's terms, data is stored and ML processing runs in the EU. Under Google Cloud's terms (Service Specific Terms), Google does not use customer data to train AI/ML models without our permission. One exception: the optional company and site web research (Google Search grounding; currently switched off for all customers) is excluded from Google's EU commitment, so it may be processed outside the EU, and Google keeps grounding queries for up to 3 days (this cannot be disabled). It sends public business identifiers (no order, document or driver data; no contact records from your Druma account). AI Disclosure publicly available.
Audit logging
Inserts, updates and deletes on core tables — orders, invoices, documents, users, company memberships, API keys and more — are recorded in audit_log with the caller's identity, timestamp, and old/new values, and kept for 12 months. Reads are not recorded there. Searchable and filterable in-app, and exportable for your own records.
Error monitoring
Production runtime errors flow through Sentry, and scheduled-job failures and Edge Function drift raise alerts. These are point tools read by a person: there is no SIEM and no 24/7 on-call. No tracking pixels — Druma's marketing site explicitly does not run analytics.
Optional 2FA + idle timeout
Per-company TOTP enforcement, configurable session idle timeout (with a 2-minute warning banner before logout), and signup rate limiting. Carrier portal tokens auto-expire after 30 days.
Storage hardening
Every storage bucket has explicit file_size_limit + allowed_mime_types at the database level, plus company-scoped RLS using path-prefix UUID matching. Client-side and server-side MIME validation on every upload helper.
Hardened deploys
Migrations and Edge Functions auto-deploy from main via GitHub Actions — no manual production access. PR validation gates (tsc, vitest, build, i18n lint) must pass before merge. Six full-stack security audit passes completed, most recently August 2026.
Answers to the questions procurement asks
Published so you do not have to send us a spreadsheet to find out. Some of these answers are no — we would rather you learn that here than after signing.
Are you NIS2 compliant?+
There is nothing for us to hold. NIS2 applies to essential and important entities; a transport management system falls in no Annex I or II sector, and Druma is far below the 50-employee / €10M threshold. Any vendor offering you a "NIS2 certificate" is describing something that does not exist. What we do instead is make it easy for you to answer your own supply-chain obligations about us — this page, the DPA, the sub-processor list and our vulnerability disclosure policy are all public, with no NDA. Worth knowing: if you are a haulier, you are very likely out of scope too. The Road subsector covers road authorities and intelligent-transport-system operators, not carriers or freight forwarders. The request usually originates with your shipper, who is in scope.
Where is our data, and does it leave the EU?+
Database, file storage and server functions are hosted in the EU (Ireland). The web front end is served through Cloudflare's global edge network, which is not confined to the EU. A number of named recipients may process data outside the EEA — for example Cloudflare (CDN), Resend (transactional email), and Supabase for remote support access to the EU-hosted database — each listed in Annex III of our Data Processing Agreement with the personal data it receives and the safeguard that covers it. Our AI requests are processed on Google Vertex AI's EU multi-region endpoint; according to Google's terms, data is stored and ML processing runs in the EU there, and Google Cloud's terms (Service Specific Terms) exclude training on your data. The one exception is the optional company and site web research (Google Search grounding), which Google's terms exclude from the EU commitment, so it may be processed outside the EU; Google keeps grounding queries for up to 3 days and this cannot be disabled; it sends public business identifiers (company or site name, country, city, VAT number and validity flag, VIES legal name, website address, and the public text of a site's own website), with no order, document or driver data and no contact records from your Druma account; the public text of a company's own website and a sole trader's business name may incidentally contain personal data.
Can we force two-factor authentication on everyone?+
Yes, per company, and it is enforced in the database rather than only in the web app — so it holds for direct API access too, not just for someone using the browser. The honest scope: it covers the planner application and privileged server actions. It does not apply to the driver app (drivers sign in with a PIN and have no authenticator flow), to shared portal links, or to API tokens.
Do you hold ISO 27001 or SOC 2?+
No, and we do not claim to. What exists is six internal full-stack security audits, the most recent in August 2026, and a published description of our controls that you can check against this product. Our target is CyberFundamentals Basic — the level Belgium’s Centre for Cybersecurity explicitly recommends organisations require of their suppliers. If a certificate is a hard requirement for you, we will not pass that gate today.
How fast would you tell us about a breach?+
Within 48 hours of becoming aware of a personal-data breach affecting your data, and in any event without undue delay. That is a contractual commitment in the DPA, and our internal runbook works to a tighter 24-hour target. Being straight about the limit: that commitment covers personal-data breaches. An availability or integrity incident with no personal-data element triggers no contractual notice today. Druma is operated by one person and there is no 24/7 on-call rota.
What happens if it all breaks?+
Daily automated backups, retained 7 days. Our documented objectives are a recovery point of 24 hours and a recovery time of 8 working hours, with the procedure, seven scenarios and the known gaps written down and available on request. Two things we will not overstate: a full restore has not yet been rehearsed, so those figures are derived from platform behaviour rather than demonstrated; and backups currently live in the same provider account as production, which is the top item on our own risk register.
Do you support SSO, and is there an SLA?+
No to both, today. Sign-in is by email and password or Google/Microsoft OAuth; there is no SAML or OIDC single sign-on and no domain enforcement. There is also no committed availability percentage — our Terms of Service say so explicitly rather than leaving it implied. If either is a requirement, tell us; neither is a secret and both are on the roadmap rather than in the product.
Reporting a vulnerability
Found something? Email us. There is no bug bounty and no NDA to sign — a good report gets the same response whichever channel it arrives on. Please test against your own account only: Druma is multi-tenant and carries live freight, driver and invoicing data for operating hauliers.
We acknowledge within
3 working days
Initial assessment
10 working days
Fix, high & critical
30 days
Out of scope: our sub-processors’ own infrastructure, findings needing a compromised device, missing hardening headers with no demonstrated impact, scanner output without a proof of concept, and anything that degrades service for real operators. We will not pursue anyone acting in good faith under this policy.
Procurement-ready paperwork
Druma's Data Processing Agreement, Privacy Notice, sub-processor list, and AI Disclosure are publicly available — no NDA required to read what we do with your data.
// SECURITY POSTURE
HOSTING: Supabase EU (Postgres + Storage + EFs)
ISOLATION: Row-level security per company
ENCRYPTION: TLS 1.2+ in transit · AES-256 at rest (provider-managed)
AUTH: JWT (Supabase Auth) · TOTP optional · OAuth Google/Microsoft
AI: Google Vertex AI · EU multi-region endpoint · no training on customer data without permission
AUDITS: 6 full-stack passes · latest Aug 2026
SOC 2/ISO 27001: not held
STATUS: AUDITED, NOT CERTIFIED