Trust & security
Retailers trust us with their customers’ names, addresses and orders. Here’s exactly how CBC Dispatch protects them — written in plain language, describing controls that are running today.
Your data stays in your account
- Every shipper account is separated. Orders, customers, inventory and reports are tagged to the account that owns them, and screens and APIs only return records for that account.
- Access is role-based. Admins, dispatchers, warehouse staff, drivers, delivery agents, shippers and end customers each see only the screens and records their role needs, enforced on the server, not just hidden in the app.
- Partner delivery agents in our network never see which retailer an order belongs to, what we charge, or which other systems we use — only the stops assigned to them and their own pay.
Credentials and integrations
- Partner API keys are stored only as SHA-256 hashes and compared in constant time. Keys can be rotated with an overlap window, revoked instantly, and optionally require signed requests. Every API call is logged.
- Online-store credentials (Shopify, WooCommerce, BigCommerce) are encrypted at rest with AES-256-GCM and are only ever decrypted inside our servers — they are never sent to a browser.
- Incoming store webhooks are rejected unless their cryptographic signature matches the store’s secret, so orders can’t be forged into the system.
- Website widgets (delivery-date picker and tracking) use publishable keys that only work on the websites you list, can only read availability or your own orders, and can never change anything.
Privacy-safe tracking for your customers
- Tracking links use long random tokens that can’t be guessed. Looking up an order without a link requires both the order number and the phone or email on the order.
- Tracking shows the recipient only their own delivery — status, date, time window and arrival estimate. Pricing, CBC’s internal notes and other customers’ details are never exposed, and the order-number lookup and website widget don’t show street addresses at all.
- Every public endpoint is rate-limited per visitor to stop scraping and guessing.
- Our pages can’t be embedded inside other websites, which blocks click-jacking attempts.
Accountability
- Administrative changes — users and permissions, company settings, contracts and rates — are written to an audit log showing who changed what and when.
- Every delivery keeps a timestamped event history and photo/signature proof of delivery, so disputes are settled with records, not memory.
- Customer text messages follow carrier (10DLC) consent rules. Opt-outs are honoured automatically, and consent data is never shared for marketing.
Your rights over your data
- We do not sell personal information or share it with advertisers or data brokers.
- Anyone can request deletion of their account and personal data — no sign-in required — and we confirm by email. Financial and delivery records required for tax, insurance and claims are kept only as long as the law and our obligations require.
Security reviews and questionnaires
We’re happy to complete your vendor security questionnaire or walk your IT team through how data flows between your systems and ours. CBC Dispatch is not currently SOC 2 certified; if your procurement process requires it, tell us and we’ll discuss timing. Email support@cbcmoving.com.
See also our Privacy Policy and Terms. To report a security concern, email support@cbcmoving.com with “Security” in the subject.