Data policy

NoxTMS is made and run by a software company. We are not a freight brokerage: we do not broker freight, we do not compete for your customers or your carriers, and no brokerage owns us or can see into your workspace.

Brokers who advise us on the product, or use it, are customers like you. They see their own workspace and nothing else.

We make our money from the subscription, never from your data.

• Emails you forward to your intake address, or that we read from a mailbox you connect, with their attachments.
• Documents: rate confirmations, PODs, BOLs, certificates of insurance, W-9s, carrier agreements, invoices and anything you upload.
• Your records: customers, carriers, contacts, facilities, quotes, loads, stops, tracking updates, charges, invoices, carrier bills and payments.
• What carriers and customers send through their links: bids, positions, documents and the acceptance of a rate confirmation.
• The history: a timeline for every quote and load, and an audit log of changes in the workspace.
• About the people in the workspace: each member's name and email and how they sign in. Passwords are kept only as one-way hashes.
• Usage: what each assistant call cost and how many loads were booked, to keep to your budget and your plan.

• Only the members of your workspace. Every page, download and action checks that the person signed in is a current member of the workspace the data belongs to.
• A carrier or a customer sees only what their link opens: the one offer, load or packet it was sent for. Links stop working when they are revoked or when the deal ends.
• Our staff do not access your workspace, except with your written permission to help with a support request, and only for that request.
• Workspaces are kept apart: every record carries the workspace it belongs to, and every read is limited to it.

• We never build or sell aggregate rate products. No market rate index, benchmark, lane report or "market intelligence" is made from your rates, alone or combined with anyone else's.
• We never sell, rent or share your lanes, rates, customers, carriers or contacts, with anyone: not other brokers, carriers, shippers, load boards or data brokers.
• We never train AI models on your data, ours or anyone else's. The assistant reads your data only to do the task in front of you.
• We never use one workspace's data in another. Lane history and price suggestions in your workspace come from your own loads.
• We never contact your customers or carriers for our own purposes. Every message goes out for your work, in your workspace's name.

Each one gets only what its job needs.

• Our hosting provider runs the application, and a managed PostgreSQL host stores the workspace: records, mail and documents. Ask us which providers and regions are in use; we tell workspace owners before we add or replace one.
• Google Gemini reads incoming mail and documents to sort them, pull out the details and draft replies for you to approve. We use Google's paid API, whose terms do not let Google use the content to improve its products.
• Postmark receives the mail sent to your intake address and hands it to us.
• Resend sends the workspace's mail when it does not go out through your own mailbox.
• Gmail or Outlook, only if you connect a mailbox: we read new mail to capture freight email and, if you allow it, send as you. You can disconnect it in Settings at any time.
• Google or Microsoft confirm who you are, if you sign in with them.
• The push service of your phone or browser carries notifications, if you turn them on. Each notification is encrypted so the service cannot read it.

• While your workspace exists we keep its records, documents and mail, including the full text of emails, so the history behind every load stays with it.
• When the owner deletes the workspace, everything in it is erased 7 days after the request, and its members lose access to it. During those 7 days carrier and customer links are switched off, mailbox sync and phone notifications stop, and an owner or admin can cancel, which switches them back on. If an export was started in the hour before, the erasure waits until that hour has passed.
• Sign-in accounts are not erased with a workspace: a person's account is their own and can belong to other workspaces. A sign-in account is removed on your request.
• Our database host keeps backups for disaster recovery. Backups expire within 30 days, so an erased workspace is gone from them within 30 days of its erasure.

• Export everything, at any time and at no charge: in Settings, Workspace, an owner or admin downloads a zip with every record as CSV files, every document and attachment, and a copy of this policy. Working carrier and customer links in its records read [link removed].
• Delete the workspace: the owner can do it in Settings, Workspace. It is erased 7 days later.
• A copy of this policy: it is at /policy and in every export. The version your workspace accepted is recorded on it.
• Delete your sign-in account: ask us, using the contact below, and we remove it. Deleting a workspace does not.
• Anything else, such as a copy of what we hold about you as a person: ask us, using the contact below.

• Connections to NoxTMS are encrypted in transit (HTTPS).
• Mailbox access tokens are encrypted at rest (AES-256-GCM) with a key kept outside the database.
• Membership is checked on every request: a person removed from a workspace loses access at once, even with an open session.
• Carrier and customer links are long random tokens, each scoped to one offer, load or packet, and they can be revoked.

Use the support address on our website for questions, requests or a security report. A person reads every message.