Need Help
close button

How can we help?

Select One:

Trust Center Controls

Shape
Change Management

Production Data Use is Restricted

  • Production data is not used in the development and testing environments, unless required for debugging customer issues.

Secure Development Policy

  • A Secure Development Policy defines the requirements for secure software and system development and maintenance.

Segregation of Environments

  • Development, staging, and production environments are segregated.

Change Management Policy

  • A Change Management Policy governs the documenting, tracking, testing, and approving of system, network, security, and infrastructure changes.

Baseline Configurations

  • Baseline configurations and codebases for production infrastructure, systems, and applications are securely managed.

Software Change Testing

  • Software changes are tested prior to being deployed into production.

Configuration and Asset Management Policy

  • A Configuration and Asset Management Policy governs configurations for new sensitive systems

Approval for System Changes

  • System changes are approved by at least 1 independent person prior to deployment into production.

Backup Restoration Testing

  • Backed-up data is restored to a non-production environment at least annually to validate the integrity of backups.

Business Continuity and Disaster Recovery Policy

  • Business Continuity and Disaster Recovery Policy governs required processes for restoring the service or supporting infrastructure after suffering a disaster or disruption.

Automated Backup Process

  • Full backups are performed and retained in accordance with the Business Continuity and Disaster Recovery Policy.

High Availability Configuration

  • The system is configured for high availability to support continuous availability, when applicable.

Testing the Business Continuity and Disaster Recovery Plan

  • The Business Continuity and Disaster Recovery Plan is periodically tested via tabletop exercises or equivalents. When necessary, Management makes changes to the Business Continuity and Disaster Recovery Plan based on the test results.

Cybersecurity Insurance

  • Cybersecurity insurance has been procured to help minimize the financial impact of cybersecurity loss events.

Internal Control Policy

  • An Internal Control Policy identifies how a system of controls should be maintained to safeguard assets, promote operational efficiency, and encourage adherence to prescribed managerial policies.

Organizational Chart

  • Management maintains a formal organizational chart to clearly identify positions of authority and the lines of communication, and publishes the organizational chart to internal personnel.

Acceptable Use Policy

  • An Acceptable Use Policy defines standards for appropriate and secure use of company hardware and electronic systems including storage media, communication tools and internet access.

Advisor Meetings on Security

  • Senior management and/or board of directors meets at least annually to review business goals, company initiatives, resource needs, risk management activities, and other internal/external matters. The information security team meets at least annually to discuss security risks, roles & responsibilities, controls, changes, audit results and/or other matters as necessary.

Information Security Policy

  • An Information Security Policy establishes the security requirements for maintaining the security, confidentiality, integrity, and availability of applications, systems, infrastructure, and data.

Disciplinary Action

  • Personnel who violate information security policies are subject to disciplinary action and such disciplinary action is clearly documented in one or more policies.

Performance Review Policy

  • A Performance Review Policy provides personnel context and transparency into their performance and career development processes.

Code of Conduct

  • A Code of Conduct outlines ethical expectations, behavior standards, and ramifications of noncompliance.

Performance Reviews

  • Internal personnel are evaluated via a formal performance review at least annually

Personnel Acknowledge Security Policies

  • Internal personnel review and accept applicable information security policies at least annually.

Independent Advisor

  • The board of directors or equivalent entity function includes senior management and external advisors, who are independent from the company’s operations. An information security team has also been established to govern cybersecurity.

Background Checks

  • Background checks or their equivalent are performed before or promptly after a new hires start date, as permitted by local laws.

Security Awareness Training

  • Internal personnel complete annual training programs for information security to help them understand their obligations and responsibilities related to security.

Roles and Responsibilities

  • Information security roles and responsibilities are outlined for personnel responsible for the security, availability, and confidentiality of the system.

Information Security Program Review

  • Management is responsible for the design, implementation, and management of the organization’s security policies and procedures. The policies and procedures are reviewed by management at least annually.

New Hire Screening

  • Hiring managers screen new hires or internal transfers to assess their qualifications, experience, and competency to fulfill their responsibilities. New hires sign confidentiality agreements or equivalents upon hire.

Internal Control Monitoring

  • A continuous monitoring solution monitors internal controls used in the achievement of service commitments and system requirements.

Data Classification Policy

  • A Data Classification Policy details the security and handling protocols for sensitive data.

Access to Customer Data is Restricted

  • Access to, erasure of, or destruction of customer data is restricted to personnel that need access based on the principle of least privilege.

Data Retention and Disposal Policy

  • A Data Retention and Disposal Policy specifies how customer data is to be retained and disposed of based on compliance requirements and contractual obligations.

Disposal of Customer Data

  • Upon customer request, Company requires that data that is no longer needed from databases and other file stores is removed in accordance with agreed-upon customer requirements.

Retention of Customer Data

  • Procedures are in place to retain customer data based on agreed-upon customer requirements or in line with information security policies.

Vulnerability Scanning

  • Vulnerability scanning is performed on production infrastructure systems, and identified deficiencies are remediated on a timely basis.

Vulnerability and Patch Management Policy

  • A Vulnerability Management and Patch Management Policy outlines the processes to efficiently respond to identified vulnerabilities.

Incident Response Plan

  • An Incident Response Plan outlines the process of identifying, prioritizing, communicating, assigning and tracking confirmed incidents through to resolution.

Incident Response Plan Testing

  • The Incident Response Plan is periodically tested via tabletop exercises or equivalents. When necessary, Management makes changes to the Incident Response Plan based on the test results.

Tracking a Security Incident

  • Identified incidents are documented, tracked, and analyzed according to the Incident Response Plan.

Lessons Learned

  • After any identified security incident has been resolved, management provides a “Lessons Learned” document to the team in order to continually improve security and operations.

Vendor Risk Management Policy

  • A Vendor Risk Management Policy defines a framework for the onboarding and management of the vendor relationship lifecycle.

Risk Assessment

  • Formal risk assessments are performed, which includes the identification of relevant internal and external threats related to security, availability, confidentiality, and fraud, and an analysis of risks associated with those threats.

Risk Register

  • A risk register is maintained, which records the risk mitigation strategies for identified risks, and the development or modification of controls consistent with the risk mitigation strategy.

Risk Assessment and Treatment Policy

  • A Risk Assessment and Treatment Policy governs the process for conducting risk assessments to account for threats, vulnerabilities, likelihood, and impact with respect to assets, team members, customers, vendors, suppliers, and partners. Risk tolerance and strategies are also defined in the policy.

Vendor Due Diligence Review

  • Vendor SOC 2 reports (or equivalent) are collected and reviewed on at least an annual basis.

Vendor Risk Assessment

  • New vendors are assessed in accordance with the Vendor Risk Management Policy prior to engaging with the vendor. Reassessment occurs at least annually.

Network Security Policy

  • A Network Security Policy identifies the requirements for protecting information and systems within and across networks.

Restricted Port Configurations

  • Configurations ensure available networking ports, protocols, services, and environments are restricted as necessary, including firewalls.

Network Traffic Monitoring

  • Security tools are implemented to provide monitoring of network traffic to the production environment.

Automated Alerting for Security Events

  • Alerting software is used to notify impacted teams of potential security events.

Endpoint Security

  • Company endpoints are managed and configured with a strong password policy, anti-virus, and hard drive encryption

Logging and Monitoring for Threats

  • Logging and monitoring software is used to collect data from infrastructure to detect potential security threats, unusual system activity, and monitor system performance, as applicable.

Access to Product is Restricted

  • Non-console access to production infrastructure is restricted to users with a unique SSH key or access key

Encryption-in-Transit

  • Service data transmitted over the internet is encrypted-in-transit.

Administrative Access is Restricted

  • Administrative access to production infrastructure is restricted based on the principle of least privilege.

Removal of Access

  • Upon termination or when internal personnel no longer require access, system access is removed, as applicable.

Complex Passwords

  • Personnel are required to use strong, complex passwords and a second form of authentication to access sensitive systems, networks, and information

Access Control and Termination Policy

  • An Access Control and Termination Policy governs authentication and access to applicable systems, data, and networks.

Encryption and Key Management Policy

  • An Encryption and Key Management Policy supports the secure encryption and decryption of app secrets, and governs the use of cryptographic controls.

Encryption-at-Rest

  • Service data is encrypted-at-rest.

User Access Reviews

  • System owners conduct scheduled user access reviews of production servers, databases, and applications to validate internal user access is commensurate with job responsibilities.

Least Privilege in Use

  • Users are provisioned access to systems based on principle of least privilege.

Asset Inventory

  • A list of system assets, components, and respective owners are maintained and reviewed at least annually

Unique Access IDs

  • Personnel are assigned unique IDs to access sensitive systems, networks, and information

Physical Security Policy

  • A Physical Security Policy that details physical security requirements for the company facilities is in place.

Privacy Policy

  • A Privacy Policy to both external users and internal personnel. This policy details the company’s privacy commitments.

Terms of Service

  • Terms of Service or the equivalent are published or shared to external users.

Description of Services

  • Descriptions of the company’s services and systems are available to both internal personnel and external users.

Communication of Critical Information

  • Critical information is communicated to external parties, as applicable.

Communication of Security Commitments

  • Security commitments and expectations are communicated to both internal personnel and external users via the company’s website.

Confidential Reporting Channel

  • A confidential reporting channel is made available to internal personnel and external parties to report security and other identified concerns.

Request Arrive's SOC 2 Report

"*" indicates required fields

Scott Sandager,
Chief Administrative Officer 

Scott Sandager is the Chief Administrative Officer at Arrive Logistics. He joined Arrive in 2018, bringing over 14 years of logistics and brokerage experience, with expertise in project and change management, organizational design, talent development and customer satisfaction. Scott previously held many diverse roles of increasing responsibility with AFN, a Chicago-based freight brokerage.

Subscribe to receive freight market updates​​

"*" indicates required fields


Quick Apply

"*" indicates required fields

Max. file size: 50 MB.

Arrive Carrier Requirements

Please have the following info ready to complete registration

  • MC, MX, DOT, or state reg #
  • Tax ID & W9 info
  • Cert of Insurance: $100k cargo, $1M Auto, & $1M commercial general liability coverage
  • Active Common or Contract Authority (365+ days)
  • Safety Rating of at least Satisfactory (or None)

Fraud Prevention

Freight fraud continues to impact our industry. We encourage shippers and carriers to reach out to Arrive immediately if there is ever a shipment in question that may be subject to fraud. Arrive will not ask you to pay upfront for any dedicated lane or committed capacity program. If the offer you are receiving sounds too good to be true or unrealistic, it may be fraud. Arrive Logistics recommends verifying all communications come from our registered email domain is @arrivelogistics.com. Our 24/7 phone number is 888-861-0650 and our leadership team can also be reached at feedback@arrivelogistics.com.

Use of Cookies

We use cookies to enhance your browsing experience, serve personalized ads or content, and analyze site traffic. By continuing to use this website, you acknowledge and consent to our use of cookies as detailed in our privacy policy.

Get Access to the Shipper Portal

Current Customers

Already shipping with Arrive?

Connect with your representative to get access to your ARRIVEnow Shipper Portal. Can’t connect with your rep? Use this form to reach out.

New Customers

Not shipping with Arrive yet?

If you’re not an Arrive customer, please join our network to access the portal.

Carrier Scorecard Feedback

Contact Us

"*" indicates required fields

Matt Pyatt, Chief Executive Officer

Matt Pyatt is the Chief Executive Officer of Arrive Logistics. He co-founded Arrive with President Eric Dunigan in 2014 after building his career at Command Transportation. As CEO, he is responsible for overseeing the company’s financial health, strategic vision and culture, as well as building a scalable leadership team to support Arrive’s growth.

Tim Denoyer,
VP and Senior Analyst at ACT Research

As VP and Senior Analyst at ACT Research, Tim analyzes commercial vehicle demand and alternative powertrain development (i.e. electrification), and authors the ACT Freight Forecast, U.S. Rate and Volume Outlook. He previously spent fifteen years in equity research focused primarily on the transportation, machinery, and automotive industries, and co-founded leading equity research firm Wolfe Research.

Eric Dunigan,
President & Co-Founder

Eric Dunigan is the President of Arrive Logistics. He began his career at Command Transportation before co-founding Arrive with Matt Pyatt in 2014. As president, he is responsible for driving revenue and growth, as well as leading the Strategic Partnerships team — a veteran group of supply chain experts who work with Arrive’s customers to reimagine their shipping strategy.

Arrive Logistics VP of Market Intelligence David Spencer Headshot

David Spencer,
VP of Market Intelligence

David Spencer is the Vice President of Market Intelligence at Arrive Logistics. David joined Arrive in 2017 after spending six years at AFN focused on business intelligence. His department provides critical market data and expert analysis to internal teams and publishes monthly market updates for shippers and carriers under the Arrive Insights banner.

Andrew Clarke, Board Chair,
Arrive Logistics and Global Critical Logistics

Andrew Clarke is Board Chairman for Global Critical and DCLI, Inc., and a board member for Arrive Logistics and Element Fleet Management Corp. His 20 years of global transportation and logistics experience include time as CFO of C.H. Robinson, CEO of Panther Expedited Services, Inc. and SVP and CFO roles at Forward Air Corporation.

Dean Croke,
Principal Analyst
at DAT Freight and Analytics

Dean Croke is a Market Analyst at DAT Solutions, where he focuses on freight market intelligence and data analytics. His 35 years of experience with data analytics, transportation, supply chain management, mining and insurance risk management include time as co-founder of FleetRisk Advisors and in a number of other high-level roles with FreightWaves, Spireon, Lancer Insurance, Omnitracs Analytics (formerly Qualcomm) and more.

Asanka Jayasuriya,
CTO and Partner at 8VC

Asanka Jayasuriya is the CTO at 8VC. He is an accomplished engineering and product leader with 20+ years of experience in the cloud. He has a strong background in enterprise SaaS, PLG products, infrastructure, and security. Notably, he served as CTO and SVP of Engineering at SailPoint, leading their successful transition to the cloud and successful exit event. He also held senior leadership roles at InVision, Atlassian, and Amazon, driving growth, operational excellence, and innovation. At 8VC, Asanka works with the entrepreneurs and leaders in our portfolio as a virtual CTO supporting their growth.

Chad Eichelberger,
President at Reliance Partners

Chad Eichelberger is the President of Reliance Partners. Since 2015, he’s leveraged his extensive experience in risk management, compliance, best practices and contracts to lead the company’s logistics and truck insurance strategy and operations. Chad was previously the President of Access America Transport, where he led the company from $8M to over $600M in revenue.

Barry Conlon,
CEO & Founder at Overhaul

Barry Conlon is the CEO and founder of Overhaul, the global leader in active supply chain risk management and intelligence. With a remarkable career spanning over 30 years in supply chain security, he is widely regarded as a trailblazer in modern-day supply chain security standards and best practices.

Download this Report

"*" indicates required fields

Add me to the monthly distribution