Security & privacy
Security you can verify.
EU hosting. GDPR. Audit trail.
You are responsible for customer, driver and carrier data. That is why we openly document how LogCon protects it.
Live activity
- Undo
Order A-2026-004711 created from e-mail
2 min ago
- Undo
Order confirmation sent to customer
2 min ago
- Undo
Tour dispatched with GU-481 LC
1 min ago
- Undo
ETA 14:30 reported to customer (Italian)
just now
Every AI action is logged and can be rolled back.
Transport workflow illustration
Hosting in the EU
Operated in data centres within the EU. Internal services such as database and storage are not publicly reachable.
Encryption
TLS 1.2+ for every connection. Integration credentials encrypted with AES-256-GCM and masked in API responses.
Passwords & keys
Passwords hashed with bcrypt, API keys stored as SHA-256 hashes only, sign-in via expiring JWT.
Sign-in, 2FA & SSO
Two-factor authentication with TOTP or passkeys (WebAuthn), enforceable for all users by policy, mandatory for platform administrators. Single sign-on via OIDC (Entra ID, Google Workspace, Okta) and SAML 2.0 with domain verification, JIT and SCIM provisioning. Account lockout after repeated failed attempts.
Roles & tenant separation
Ten standard roles plus custom roles with field permissions for prices and margin, branches with their own data access. Every table carries the tenant ID, every query filters on it.
Audit log
Every change and every AI action with actor, time and before/after state – filterable and exportable for administrators. Documents with SHA-256 checksum.
Backups
Daily encrypted backup of the database and documents, retained for up to 12 months; the encrypted copy outside the main data centre exists once an off-site target is set up (see sub-processors). An automated restore drill restores the backup into a separate database every week and verifies tables and document checksums.
Retention & deletion
Automatic deletion jobs for notifications, spam e-mails, Copilot conversations and expired proposals after fixed periods.
Secure interfaces
Webhooks with HMAC-SHA256 signatures, scoped API keys, rate limits against abuse.
AI with transparency – in the spirit of the EU AI Act
LogCon agents make no decisions about people. They create proposals that, depending on the autonomy level, are reviewed by a person or executed automatically – logged and reversible.
- Every AI run logged with model, tokens, cost and duration
- Every proposal with confidence, reasoning and risks
- Automatic actions with undo
- Open proposals expire after 72 hours
- AI-generated messages are labelled as such
- Kill switch sets every agent to “proposal”
GDPR in practice
Data processing
DPA under Art. 28 GDPR with technical and organisational measures as an annex, accepted online with one click. Record of processing activities exportable as CSV, JSON or PDF.
Sub-processors
Complete list with purpose, data and location – we announce changes 30 days in advance.
Data subject rights
Access packages under Art. 15, erasure under Art. 17 with retention checks and a deletion log, complete data export as a ZIP (JSON, CSV, documents).
Sub-processors and recipients
The following service providers process personal data on our behalf. We announce changes to customers at least 30 days in advance.
| Provider | Purpose | Data categories | Location / legal basis |
|---|---|---|---|
| (to follow) | Operation of application, database, file storage and backups | All data stored in the service | EU – (to follow); DPA, technical measures described in the TOMs |
| Anthropic PBC | AI models (Claude) for agents and Copilot | E-mail content, document text, order and master data as context of the respective request | USA – third country; standard contractual clauses or EU-US Data Privacy Framework; no training on customer data |
| Stripe Payments Europe, Ltd.only for paid subscriptions | Billing of paid subscriptions | Name, e-mail address, billing address; payment data is collected by Stripe directly | Ireland (EU); transfer to Stripe, Inc. (USA) possible – standard contractual clauses |
| (to follow) | Sending system e-mails (e.g. confirmations, password reset, notifications) | E-mail address, name, message content | (to follow) |
| OpenStreetMap services (Nominatim, OSRM)optional, depending on configuration | Address geocoding and route calculation | Addresses (company addresses) or coordinate pairs – no personal data | EU/UK or depending on server; own instances recommended in production |
| Telematics providers (e.g. Webfleet, Samsara)only if activated by the customer | Import of vehicle positions | Position data, vehicle identifiers | Contract between customer and provider; LogCon only provides the interface |
| TIMOCOM GmbHonly if activated by the customer | Freight exchange | Freight offers, company contacts | Germany; contract between customer and provider |
Security question or found a vulnerability?
Write to us via the contact form – we will reply confidentially.
Copilot
Your transport-file Copilot
Find orders, understand operations and prepare changes using the context of your current page and tools available to your role.
Relevant workflows: Explore the original interface, available tools and approvals in the handbook and demo.
Available tools depend on role, plan and configuration. Copilot mutations prepare proposals. Background agents separately follow configured autonomy levels.