Information Security Policy

This Information Security Policy establishes the security framework for Silk Route Logistics Inc. ("SRL", "the Company"). It defines the controls, standards, and procedures that protect the confidentiality, integrity, and availability of company information assets.

1.1 Scope

This policy applies to:

• All employees, contractors, and third-party service providers
• All information systems, applications, and infrastructure
• All data processed, stored, or transmitted by the Company
• The SRL web platform, Account Executive Portal, Carrier Portal, and Shipper Portal

1.2 Data Classification

2.1 Roles & Responsibilities

2.2 Security Reviews

Security posture is reviewed quarterly. This policy is reviewed and updated annually or when significant changes occur to the technology stack, regulatory environment, or business operations.

3.1 Role-Based Access Control (RBAC)

SRL implements strict RBAC with the principle of least privilege. The system defines the following roles:

3.2 Account Management

• User accounts are created with minimum required permissions
• Account deactivation immediately revokes all access tokens
• Inactive accounts are flagged for review after 90 days
• Shared accounts are prohibited; each user has a unique identity

4.1 Multi-Factor Authentication (MFA)

SRL enforces multi-factor authentication for all user accounts:

• Factor 1: Password (validated against security policy)
• Factor 2: One-Time Passcode (OTP) delivered via email
• Factor 3 (Optional): TOTP authenticator app (available for employee accounts)

TOTP-based 2FA uses AES-256-GCM encrypted secrets with 8 emergency backup codes.

4.2 Password Policy

4.3 Session Management

• JWT tokens issued with HS256 algorithm and configurable expiry
• Tokens delivered via httpOnly, Secure, SameSite cookies
• Token blacklisting on logout prevents token reuse
• Token rotation on refresh — old token immediately blacklisted
• Automatic session timeout: 30 minutes for employees, 60 minutes for external users
• Warning modal displayed 2 minutes before timeout with option to extend

4.4 Brute Force Protection

• Login endpoint: Maximum 5 attempts per IP per 15-minute window
• OTP verification: Maximum 8 attempts per IP per 15-minute window
• OTP code: Maximum 5 incorrect attempts before lockout
• Password change: Maximum 5 attempts per hour
• All failed login attempts are logged with IP address for security monitoring

5.1 Encryption in Transit

• All web traffic encrypted via TLS 1.2+ (HTTPS enforced via HSTS)
• HSTS header: max-age=31536000; includeSubDomains
• API-to-database connections use SSL (enforced in production)

5.2 Encryption at Rest

• Database: PostgreSQL hosted on Neon with built-in encryption at rest
• Application-level: AES-256-GCM encryption for sensitive fields (tax IDs, insurance policy numbers)
• TOTP secrets: AES-256-GCM encrypted before database storage
• Passwords: One-way bcrypt hash (12 rounds) — never stored in plaintext
• OTP codes: SHA-256 hashed before storage

5.3 Sensitive Data Handling

• Tax IDs and insurance policy numbers are encrypted at the application layer
• Payment details are processed through secure channels
• Personal information is only accessible to authorized roles
• API responses exclude sensitive fields not needed by the requesting role

6.1 Infrastructure

6.2 Security Headers

The following HTTP security headers are enforced on all API responses:

• Content-Security-Policy: Restricts resource loading origins
• X-Content-Type-Options: nosniff — prevents MIME type sniffing
• X-Frame-Options: DENY — prevents clickjacking
• X-XSS-Protection: Enabled with block mode
• Strict-Transport-Security: Enforces HTTPS
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy: Restricts browser feature access

6.3 CORS Policy

Cross-Origin Resource Sharing is restricted to explicitly configured origins. Credentials are only accepted from whitelisted domains.

7.1 Input Validation

• All API inputs validated with Zod schema validation before processing
• Request body sanitization to prevent XSS and injection attacks
• Parameterized queries via Prisma ORM prevent SQL injection
• HTTP Parameter Pollution (HPP) prevention enabled

7.2 API Security

• JWT-based authentication with HS256 algorithm (prevents algorithm confusion attacks)
• Rate limiting on all authentication endpoints
• Request size limits to prevent payload-based attacks
• Error responses sanitized to prevent information leakage

7.3 Dependency Management

• Regular npm audit scans for known vulnerabilities
• Dependencies pinned to specific versions to prevent supply chain attacks
• Critical vulnerability patches applied within 48 hours of disclosure

8.1 Incident Classification

8.2 Response Procedures

1. Detection: Automated monitoring via security audit logs, system logs, and failed login tracking
2. Containment: Isolate affected systems, revoke compromised credentials, blacklist tokens
3. Investigation: Review audit logs, identify scope and impact
4. Recovery: Restore from backups if needed, patch vulnerabilities, reset credentials
5. Notification: Notify affected parties within 72 hours as required by applicable laws
6. Post-Incident Review: Document lessons learned, update security controls

8.3 Audit Logging

The following events are logged with timestamps, user IDs, IP addresses, and user agents:

• Login attempts (successful and failed)
• Logout events
• Password changes and resets
• OTP lockouts
• Access denied events (RBAC violations)
• Data modifications (create, update, delete operations)
• Administrative actions (user management, configuration changes)

9.1 Backup & Recovery

• Database: Automated daily backups with point-in-time recovery (Neon)
• Application code: Version controlled in Git with remote repositories
• Recovery Time Objective (RTO): 4 hours
• Recovery Point Objective (RPO): 24 hours

9.2 Availability

• Frontend served via Cloudflare's global CDN for high availability
• Backend deployed on Render with automatic restarts and health checks
• Database on Neon with automatic failover capabilities

All third-party services are evaluated for security posture before integration:

• All employees are briefed on information security policies during onboarding
• Phishing awareness: employees are trained to identify and report suspicious communications
• Credentials must not be shared, written down, or stored in plain text
• Work devices must use screen locks and up-to-date antivirus protection
• Security incidents must be reported immediately to the System Administrator
• Multi-factor authentication (TOTP) is strongly recommended for all employee accounts

Silk Route Logistics operates in compliance with applicable regulations:

• FMCSA Regulations: Carrier verification, safety scores, and authority validation
• CCPA / State Privacy Laws: User data rights, deletion requests, privacy notices
• PCI Awareness: No credit card data is stored directly; payment processing is handled through third-party providers
• CAN-SPAM Act: Email communications include unsubscribe options

The Company maintains a Privacy Policy and Terms of Service that outline data handling practices and user rights.

This policy is a living document and will be reviewed:

• Annually, at minimum
• After any security incident
• When significant changes are made to the technology stack
• When regulatory requirements change