Private early access
Company access and private evidence, controlled by role.
CarrierHelm uses backend authorization and company-scoped records to control access to operational data. These controls are subject to ongoing testing; this page is not a certification or a guarantee against incidents.
Updated October 26, 2026
Company and role controls
Protected application actions check the signed-in user, company membership, role and record scope on the server. Drivers receive access to their assigned workflow. Office roles receive the fields and actions intended for their responsibilities.
Private evidence and connected storage
Load evidence can be retained in private Supabase storage and opened through authorized application requests. A carrier may also connect its own Google Drive. Storage paths are not a substitute for authorization. Supported images may be compressed; unsupported images are preserved. A universal file-size or reduction target is not guaranteed.
Transport, access and operational limits
Public and application URLs use HTTPS. Company invitations, role checks and application audit records support access control. Backup restoration, retention commitments, service levels and production workload capacity must be established for the agreed customer service; this page does not promise specific recovery or incident-notification deadlines.
Report a vulnerability
Send a description and safe reproduction steps to carrierhelm.admin@gmail.com. Do not include passwords, tokens or other carriers’ data. Do not access another company’s records, disrupt the service or run destructive tests. We will review reports; this is not a bug-bounty offer.
Contact CarrierHelm