Security
How we protect your company's data
Loads, rates, drivers' papers and pay are the core of your business. Here is what protects them today, in plain words, and how to tell us if you find a problem.
Signing in
Getting in takes more than a password
A password and a code
Your email or phone with a password, then a 6-digit code to the email or by text. Passwords found in known data breaches are refused.
Passkeys
Face ID, Touch ID, Windows Hello or a security key, instead of typing a password.
Google or Microsoft
Sign in with either. On a device you haven't used before, a second step follows: your password, a code to your phone, or a passkey.
New-device emails
A sign-in from a device you never used before sends you an email.
Your devices
Every browser and phone signed in to your account is listed in Settings, and each one signs out with a click. A browser stays signed in at most 60 days.
Sensitive steps ask again
Adding a passkey or a phone, changing the password or deleting the account needs a recent sign-in, your password or a passkey.
Inside your company
Each person sees their part, and every change is recorded
Each company kept apart
Every request is checked against the company it belongs to, and automated tests check this on every API route. One company's loads, people and money never show in another's.
Rights checked by the server
Positions and per-person rights decide what each request may do. The screen hides what you can't use, and the server refuses it anyway.
An activity log nobody can edit
Who changed what and when, with before and after. The database refuses to change or delete an entry while the company exists.
IP allowlist
The owner can let office positions open work data only from the networks on a list. Drivers are never blocked.
Driver papers
CDL and medical card photos open only through one-time links that last 60 seconds, and every view is logged.
Support access on the record
If our support has to open your loads or papers, it needs a written reason, and the visit shows up in your activity log.
Where it lives
Your data and the keys to your connections
Cloudflare's network
The site and its servers run on Cloudflare's network.
The eastern US
Your company's data is kept in the eastern United States.
Files encrypted at rest
Rate cons, papers and photos are encrypted at rest by the storage provider.
Connection keys sealed
The keys to your connections, like QuickBooks Online and your ELD, are sealed with AES-GCM and never shown in full.
We don't sell your data or use it for advertising, and we don't use it to train general AI models. Google and Microsoft sign-in asks only for your basic profile: name, email and picture. We never get into your Gmail or Outlook; the only mail we see is what you forward to your company's address. Details are in the Privacy Policy.
Report a problem
Found a security problem? Tell us first.
Send it with the form: it reaches Cruz directly. If you'd rather use email, write to contact@thenekas.com with “Security” in the subject. We read every report. Please give us time to fix the problem before you tell anyone else.
- Test only with your own account and your own company
- Don't open, change or delete anyone else's data
- Don't run tests that slow the site down for others
- What you found, and where: the page or the API address
- The steps to see it again
- What someone could do with it
- How we can reach you
Questions about security?
Ask us, or read the Privacy Policy for what we collect and why. THENEKAS is operated by King Karom Inc., a New York corporation.