When you manage transport operations, you're also managing a lot of sensitive information: shipments, customers, carriers, orders and operational data.
That makes security an important part of the system you use to manage your transport.
At CtrlChain, security isn't based on a single feature. It works through several layers that protect your data and your access at different points, from the moment you connect to the system to the infrastructure running behind it.
The first layer starts when you connect to CtrlChain.
Your connection is encrypted using HTTPS, helping protect information as it travels between your browser and CtrlChain. Additional browser security rules help prevent common web-based attacks, such as malicious scripts running in the page or other websites embedding CtrlChain in potentially unsafe ways.
When you log in, CtrlChain uses your company's existing identity system through Microsoft Entra ID (formerly Azure Active Directory). This means your organisation can keep control over authentication and apply its own security policies, including multi-factor authentication where configured by your company.
We also use bot protection on the login page to help prevent automated abuse.
Being able to log in doesn't mean having access to everything.
Every request to CtrlChain is checked against a permission model that determines what a user can access and what actions they can perform. These permissions cover different areas of the system, while company-level restrictions help ensure users only access data belonging to their own organisation.
Access is checked on the backend as well as in the interface. This matters because hiding information on screen isn't enough if the system doesn't also enforce the same restrictions behind the scenes.
For organisations where different teams and companies work within the same system, these checks help keep information accessible to the right people without exposing data to others.
Sensitive data needs protection both when it's moving between systems and when it's stored.
CtrlChain encrypts data in transit and at rest. For stored data, we use AES-256-GCM encryption, while encryption keys are managed through Azure Key Vault and kept separate by service.
In practice, this means the protection doesn't stop once information reaches our systems. Stored data also receives an additional layer of protection, with access to the keys managed separately.
This is particularly important when dealing with transport orders, customer details and other operational information that needs to remain confidential.
Security also means knowing what's happening inside the system and being able to investigate when something needs attention.
CtrlChain collects structured logs from its services and brings monitoring information together in a centralised view. This helps our teams identify errors and unusual behaviour, understand what happened and investigate issues more efficiently.
Requests also use correlation IDs, which help connect related events across different services. Instead of looking at isolated log entries, our teams can follow a request through the system and get a clearer picture of what happened.
Audit logs provide an additional record of relevant activity, supporting traceability when an investigation is needed.
The security of a system also depends on how the infrastructure running it is configured, accessed and maintained.
At CtrlChain, infrastructure changes are managed through version-controlled configuration and automated deployment processes. This means changes can be reviewed and tracked rather than relying on undocumented manual changes.
Sensitive configuration and credentials are managed through tools such as Azure Key Vault, rather than being stored directly in application code. Certificates are also renewed automatically, helping keep connections secure without relying on manual renewal.
We monitor infrastructure and service health using dedicated monitoring tools, with alerts sent to Microsoft Teams so the relevant team can investigate when something needs attention.
These measures help keep the underlying environment controlled, traceable and maintained over time.
Security needs ongoing attention. New vulnerabilities are discovered, software dependencies change and systems need regular updates.
That's why changes to CtrlChain's production environment go through a controlled process. Main code branches are protected against direct changes, and changes require review and approval before they can be merged.
We also apply controls to the third-party software our system relies on. Open-source dependencies are version-locked, installation scripts are restricted through an allowlist, and new packages are quarantined for 48 hours. Dependencies are reviewed regularly, and frameworks are kept up to date so security patches can be applied promptly.
These practices help reduce the risk of introducing vulnerable or unreviewed code into the system.
Cybersecurity isn't something you add at the end of building a system.
At CtrlChain, it's considered across the different parts of the system: how users connect, how their identities are verified, how access is controlled, how data is protected, how activity is monitored and how the infrastructure is maintained.
The result is a layered approach to security, where different protections work together.
Because if one layer doesn't stop something, there are other layers behind it.
Security isn't one feature. It's the combination of everything working together.