How SXT Ops handles your data
Amazon Delivery Service Partners (DSPs) keep driver records, van and repair history, invoices and timecards in SXT Ops. This page says what protects that data today, what doesn't yet, and what we don't have, in the words a careful owner would want before sending the first roster file.
Your data on our server
Everything between your browser and SXT Ops travels over HTTPS. Each company's data is kept separate, and every screen is limited by role.
Two-step sign-in secrets are stored encrypted. SXT Ops can also encrypt associates' phone numbers, injury and medical details, and text-message consent records inside the database, with a key kept apart from the data and from backups. We switch that on only after the key is saved offline, so a lost key can never cost you records. Ask us whether it is on yet.
Backups never leave our server unencrypted. Any copy kept elsewhere is encrypted first with a key that only we hold offline.
Other records, such as names, emails, write-ups, attendance, messages, incident descriptions, vehicle and repair records, and uploaded files and photos, are stored on our server without that extra layer and are protected by access roles, the server's own security and HTTPS. Our hosting provider's disks are not confirmed to be encrypted.
Amazon access
SXT Ops never signs in to Amazon and never asks for, sees or stores an Amazon password. The SXT Ops Companion extension has no access to any web page; Chrome lists no site access for it. See the Companion extension page.
Sign-in
Two-step sign-in with an authenticator app is built, and owners can require it by role. It becomes available once the extra database protection above is switched on for SXT Ops. Ask us whether it is on yet.
Who sees what
Access is by role, changes to associates, vans and repair orders are recorded with who made them and when, separation reasons and write-ups are visible only to owners, managers and HR, and associates' phone numbers and emails only to owners, managers, HR and dispatchers. Injury details are limited to owners, managers and HR, and medical details to owners and HR.
The privacy page covers the website and the extension.
Reliability
The status page shows whether the app and its parts are working, checked every few minutes. Backups run nightly and each one is verified. Copies kept off our server, and a monthly drill that restores a backup to prove it works, are being set up.
Our targets, not a promise or a service level agreement: 99.9 percent uptime each month, at most 24 hours of data lost, and a restore within 4 hours.
What we don't have
We don't have a SOC 2 report.
We don't offer single sign-on with Google or Microsoft yet.
Reporting a problem
Email contactus@sophiaxt.com about anything that looks like a security problem. A person reads it and replies. Our security.txt says the same.