How BZ Loader Secures Your Data

Handing a freight brokerage's loads, carrier records, customer data, and financial history to a piece of software is a real trust decision, and it's fair to ask exactly what protects that data rather than taking "we take security seriously" at face value. Here is specifically what BZLoader does today. Data isolation. BZLoader is multi-tenant by design — every table is scoped to a company at the data-access layer, not a shared database with a filter added on top after the fact. No other company on the platform can see another company's loads, carriers, customers, documents, or financial records, and that isolation is enforced by how the application reads and writes data, not left to be remembered per feature. Encryption. All traffic between a browser and BZLoader runs over HTTPS/TLS. Uploaded documents are encrypted at rest rather than stored as plain, directly-readable files. Authentication. Passwords are hashed with bcrypt — never stored in plain text, and never reversible even with direct database access. Real multi-factor authentication is available: authenticator-app (TOTP) codes, one-time recovery codes for account recovery, trusted-device memory so MFA isn't required on every single login from a known device, and email-based one-time codes as an alternative to an authenticator app. If someone loses their device, an administrator can force a reset rather than the account being permanently locked out. Login attempts are also rate-limited to slow down brute-force password guessing. Malware scanning. Every file uploaded to BZLoader — a document, a company logo, a file submitted through a carrier upload link — is scanned before it's stored. If the scan can't be completed for any reason, the upload is rejected rather than allowed through unscanned; the system fails closed, not open. Access control. Permissions are role-based — Owner, Admin, Dispatcher, Broker, Accounting, and more — so what a given team member can see and change matches their actual job. Business and Enterprise plans can define fully custom roles beyond the defaults. Application-level protections. Every state-changing request (creating a load, editing an invoice, changing a setting) is protected against cross-site request forgery, not just the login form — a common gap in less carefully built software. Administrative oversight. Platform-level administrative actions are tracked in an audit log, so there's a real record of who changed what rather than an assumption that nothing goes wrong internally. What BZLoader does NOT currently claim: a formal SOC 2 Type II certification, a dedicated GDPR compliance program, or a published uptime SLA. None of those exist yet, and claiming them without the real work behind them would be worse than not mentioning them at all. If a specific compliance requirement or security questionnaire matters for an evaluation, the honest answer is to ask directly rather than assume from a feature list — including this one.