AI in Trucking Software: Where Your Data Goes

AI is showing up in every kind of trucking software, and much of it is genuinely useful. But AI features work by sending your information to a model, usually run by an outside company. For a carrier, that information can include some of the most sensitive data any small business holds.

This article explains where the data goes, what the AI providers' own terms say, and what to ask before you turn AI on.

What a trucking company has to protect

Driver records: Social Security numbers, dates of birth, CDL numbers, medical certificates, MVRs and home addresses.
Drug and alcohol test results. Federal DOT rules (49 CFR 40.321) prohibit employers from releasing individual test results to third parties without the employee's specific written consent.
Money: bank details for drivers and owner-operators, factoring accounts, and what every broker pays you on every lane.
Customers: shippers, brokers, contacts and contracts.

Criminals know this. In 2026, the Oregon carrier May Trucking disclosed a ransomware attack in which names and Social Security numbers were exposed, and it mailed notification letters to affected people in August. Trucking is a target like any other industry, and AI adds new paths for data to leave the company if it's not built carefully.

Risk 1: people pasting company data into chatbots

The most common AI leak isn't a hack. It's an employee pasting a driver list, a settlement or a contract into a free chatbot to get help with it. In 2023, Samsung banned staff from using generative AI tools after engineers uploaded sensitive internal source code and meeting notes to ChatGPT. Samsung's concern was that data sent to such services is stored on outside servers, where it's hard to retrieve or delete.

The fix is partly policy and partly giving people a safe tool. When AI is built into the TMS, with controls, staff have less reason to copy data into a consumer app.

Risk 2: free AI tiers can use your data

The terms differ a lot between free and paid AI services, and between consumer apps and business APIs:

Google's Gemini API terms say that for unpaid services, Google uses submitted content and responses to improve its products and machine learning, and human reviewers may read them. Google advises not to submit sensitive, confidential or personal information to unpaid services. For paid services, Google says it doesn't use prompts or responses to improve its products.
OpenAI's API documentation says API data isn't used to train its models unless the customer opts in, but abuse-monitoring logs, which can include prompts and responses, are kept for up to 30 days by default.

So the same AI feature can be private or not depending on which account and tier it runs through. Ask your vendor which provider they use, on which tier, and under whose account.

Risk 3: AI that reads email can be manipulated

AI that reads incoming emails and documents can be tricked by text hidden inside them, a technique called prompt injection. It's first on the OWASP Top 10 risks for applications built on large language models, and sensitive information disclosure is right behind it. An AI that can read your whole database and act on outside email needs strict limits on what it can see and do.

A checklist before you turn on AI in your TMS

Which AI provider processes our data, and on a paid business tier or a free one?
Is our data used to train or improve anyone's models? Get it in writing.
How long does the provider keep prompts and responses?
Does each AI feature receive only the data its task needs, or everything?
Can we see who used AI features and on what records?
Do employees have a safe, approved AI tool, so they don't use personal chatbots?

How Ella handles your data and AI

We built Ella for companies that want AI without giving up control of their data:

Your own private system and database. Your data is never mixed with another company's.
AI runs on your company's own business accounts. We set them up with the AI providers on paid plans, billed to you directly, and the providers' paid API terms keep your data out of model training.
Each feature sends only what its task needs. AI Load Con sends the rate confirmation, not your driver files.
Role-based permissions, secure logins and encrypted connections, so each employee sees only what their job needs, plus an activity log and audit trail.
Independent security testing. Every system goes through third-party QA and security testing by CoreTest Solutions before handoff.
Audited hosting. Hosting providers are independently audited to SOC 2 Type II, with automatic daily backups.
Email Security (part of the Gmail Suite add-on) watches for mailbox takeovers, the usual start of double brokering and payment-redirect fraud.
We don't sell, share or mine your data. You decide who has access, including whether our team does.

Read more about ownership and privacy and Ella's AI features, or talk to us about your own setup.

Frequently asked questions

Is it safe to use ChatGPT with company data?

Consumer chatbots and free tiers can keep or use what you submit, and their terms vary. Don't paste driver records, settlements or contracts into them. Use AI that runs on a business account with clear data terms.

Do AI providers train on my TMS data?

It depends on the provider and the tier. OpenAI's API and Google's paid Gemini API terms say data isn't used to train or improve their models, while Google's unpaid tiers can use submitted content. Ask your vendor which applies.

Where does Ella's AI send my data?

To the AI provider, through your company's own paid business account, and only what each task needs, such as the rate confirmation for AI Load Con. The providers' paid API terms keep that data out of model training.

AI in Trucking Software: Where Your Data Goes, and How to Keep Driver Information Safe