The security posture an enterprise broker procurement team expects.

Compliance program at a glance

Where Keelway is today, in plain language. We do not claim certifications we have not earned, and we do not hide the gaps — enterprise procurement teams smell that from a mile away.

Identity and access management

Every enterprise tenant supports the identity primitives a modern security team expects:

• SAML 2.0 and OIDC SSO — validated against Okta, Microsoft Entra ID (Azure AD), Google Workspace, and JumpCloud. Custom IdPs supported on request.
• SCIM 2.0 user provisioning — automated creation, update, and deactivation. Deactivating a coordinator in your IdP removes them from Keelway within minutes.
• Role-based access control (RBAC) — pre-built roles for broker, team lead, ops manager, billing admin, and read-only auditor. Custom roles with per-resource scope on loads, carriers, rates, and TMS write-back.
• IP allowlisting — dashboard access restricted to customer-supplied CIDR ranges on enterprise tenants.
• Session management — configurable session lifetime, mandatory MFA for admin roles, forced re-authentication for sensitive actions (TMS credential changes, billing, integration setup).

Encryption and data handling

Data is encrypted in transit (TLS 1.2 or higher on every customer connection, with HSTS preload submitted) and at rest (AES-256 on all Postgres, S3, and Redis storage). Sensitive carrier-side fields (EIN, banking details, SSN where collected for carrier setup) carry a second layer of application-level field encryption keyed to the tenant.

Customer data is never used to train shared foundation models or shared retrieval indexes. Every enterprise tenant runs against an isolated retrieval index scoped to its own data. Our LLM provider contracts (Anthropic, OpenAI) explicitly opt out of training-data use under enterprise terms.

Infrastructure and reliability

Keelway runs on AWS, with the following posture for enterprise tenants:

• Primary region: us-east-1 by default; us-west-2 and ca-central-1 available on contract.
• Dedicated tenant infrastructure for enterprise customers — isolated VPC, isolated database, isolated retrieval index, no shared model surfaces.
• Backups: point-in-time recovery on Postgres (35-day window), cross-AZ replication, daily snapshots retained 30 days, weekly snapshots retained 12 months.
• Uptime SLA: 99.9% monthly on the carrier-email ingestion path and the operator dashboard, with service credits (10% below 99.9%, 25% below 99.0%, 50% below 95.0%).
• Status page: public, real-time, with email and webhook subscriptions for enterprise customers.

Audit logs and observability

Every meaningful action — logins, accepted carriers, overridden trust scores, TMS write-backs, role changes, integration setup changes — is captured to an immutable audit log. Enterprise tenants can stream audit logs to Splunk, Datadog, Sumo Logic, or any S3 bucket they own, in near-real-time. Retention is configurable to customer policy (12 months minimum, 7 years available).

Penetration testing and vulnerability management

Independent third-party penetration testing conducted annually by a CREST-certified firm; most recent test summary available under NDA for prospective enterprise customers. Continuous automated vulnerability scanning on every deployed artifact (SAST, SCA, container image scanning, infrastructure-as-code scanning). No bug bounty program yet — report anything you find to security@keelway.com and we will acknowledge it and tell you what we did about it.

Incident response

Security events page the founding team directly. Keelway is small enough that there is no tier-one queue to sit in, and honest enough not to print an acknowledgment SLA we have not staffed a rotation for — response times are written into the enterprise contract instead. Enterprise customers are notified within 24 hours of any incident affecting their data, with a written preliminary report within 72 hours and a full post-mortem within 5 business days. We maintain a Slack Connect or Microsoft Teams shared channel for incident communication with each enterprise account. There is no public status page yet.

Subprocessors

Public subprocessors as of the current quarter:

• AWS — compute, storage, networking (us-east-1 primary, additional regions on contract)
• Cloudflare — edge, DNS, WAF, DDoS protection
• Resend — inbound carrier mail routing and outbound threaded replies
• Anthropic — LLM inference for the parser and ranking pipeline; no customer data used for model training under our enterprise terms
• OpenAI — secondary LLM inference for redundancy; same training-opt-out terms
• Stripe — billing and payment processing only; no carrier or shipper data
• Postmark — transactional email delivery (account notifications, alerts) only

Full list with data flows, geographic processing locations, and processing purpose available under NDA on request. We provide 30 days' notice before any subprocessor addition, with a right-to-object on enterprise contracts.

Responsible disclosure

Security researchers can report vulnerabilities to security@keelway.com with PGP encryption available. We commit to acknowledging within 48 hours, triaging within 5 business days, and remediating Critical / High issues within 30 days. We do not pursue legal action against good-faith researchers operating within our disclosure policy.