Privacy Policy
Last updated: November 2026 • Status: Pending formal attorney review before commercial launch
NOTICE TO CARRIERS & LEGAL COUNSEL
This privacy policy describes Verdax’s technical and organizational data handling practices. It must be reviewed and customized by counsel prior to collecting live fleet documents under formal commercial contracts.
1. Information We Strictly Do Not Collect
To safeguard carrier and driver privacy, Verdax enforces architectural boundaries against unnecessary sensitive data collection:
- No Social Security numbers: We do not store or prompt for driver SSNs.
- No banking or payment credentials: Payments are processed via PCI-compliant processors; Verdax never stores bank account or card numbers.
- No medical exam clinical records: We collect only the public Medical Examiner’s Certificate (Form MCSA-5876) required for qualification folders, never underlying physical examination histories, medical test results, or diagnostic charts.
2. Information We Collect and Process
We process only information strictly necessary to organize qualification records and track renewal deadlines:
- Carrier name, primary contact name, email address, phone number, and USDOT number.
- Driver roster entries: Driver name, hire date, commercial driver license state, and CDL status.
- Driver qualification documents: Legitimate qualification records uploaded by the carrier or driver (such as driver licenses, employment applications, and medical certificates).
- System access logs and immutable audit trails of document confirmations and deletions.
3. Storage Security & Access Controls
All uploaded documents are stored in private cloud storage buckets. We do not provide public URL access to any carrier document.
- Signed URLs: Document previews are generated on-demand using short-lived signed URLs that expire within minutes.
- Row-Level Security: Multi-tenant isolation is enforced at the database level so that no carrier organization can view or access another carrier’s records.
- Single-Use Links: File check upload links use cryptographic token hashes and automatically expire after 7 days or upon submission.
- Randomized Filenames: Uploaded files are renamed with secure random identifiers to prevent metadata leaks.
4. Data Deletion and Portability
Carriers retain full ownership of their data. Carrier administrators may request a full ZIP archive of all files at any time, or trigger a complete permanent deletion of their organization’s records and uploaded documents.
5. Questions & Data Requests
To exercise data rights or ask questions regarding privacy practices, contact the founder directly at founder@verdax.com or through the contact page.