How to Show a Customer a Price Without Revealing Your Buy Rate

The workable rule is short: the customer receives a result, never an input. A freight quote a shipper can act on needs four things — a total price, a currency, a transit time and a reference such as Q-2026-0148. It does not need the carrier name, the line-haul rate, the fuel-surcharge percentage or the margin that produced it.

Most brokers get this wrong in the same way. They build the quote in a spreadsheet that contains both prices, then delete a column, hide a sheet or set the font to white before sending. The file still contains the number. The same mistake reappears in software when a quoting screen fetches the full pricing result and hides the cost fields with a display rule — the data arrived, so the data can be read.

The separation has to happen one layer earlier, at the point where the system decides what to send. Three concrete requirements follow:

• The price is calculated server-side. Rate grids and margin rules stay on the server; the customer session sends shipment characteristics and receives a price.
• Cost fields live in a separate record with its own permission, not as hidden fields on the record the customer is allowed to read.
• Every outbound artefact is generated from the customer view, never from the internal view with fields removed.

Cargavo, the TMS for freight brokers and transport commissionaires, is built on exactly that split, which is why the customer portal can be self-service without a margin ever transiting. The rest of this guide covers the leaks that survive a correct architecture: reverse-engineering from prices, probing the simulator, and documents. For the wider portal picture, see the customer portal category.

A price calculator that runs in the browser must have the ingredients in the browser. That means the weight brackets, the zone table, the fuel-surcharge percentage and the margin coefficient all travelled across the network to a machine you do not control. Opening the developer tools and reading the response takes about fifteen seconds and requires no technical skill beyond following a screenshot.

The same reasoning applies to record-level access. Suppose a quote record holds sellPrice, purchasePrice and marginPercent side by side, and the customer portal only renders the first. If the customer account is permitted to read that record — which it must be, to see its own quote — it is permitted to read all three fields. The interface hid two of them; the permission did not.

This is why margin confidentiality belongs in the data model rather than the design system. Two structural decisions carry it:

1. Split the record. Customer-visible facts on one document, financial facts on a child document with a stricter rule.
2. Make the server the only author of prices. If a client can write a price, a client can also propose one, and you are now negotiating with your own database.

Cargavo, the TMS for freight brokers, applies both. Quotes are created only by the computeQuoteServer function, client-side creation of a quote is refused outright, and brokers may afterwards update workflow fields such as status and notes but never the priced result. The pricing engine that produces the buy price and the sell price is the same engine — the buy price is the run without margins, the sell price the run with them — which is covered in rate grid vs rate engine.

Concretely, in Cargavo a quote lives at organizations/{orgId}/quotes/{quoteId} and its financial detail at organizations/{orgId}/quotes/{quoteId}/private/financials. The parent is readable by any broker role in the organization and by the single customer whose identifier matches the quote. The child is readable only if the caller carries a broker role, and it is writable by nobody — the Cloud Function that computes the quote writes it with server credentials. The identical split exists on shipments, so an accepted quote Q-2026-0148 becoming shipment S-2026-0092 does not open a second door.

Access is decided by claims attached to the login itself — organization, role, and for a portal user a customer identifier — rather than by a query filter the client sends. That distinction matters: a filter is a request, a claim is a fact. Default-deny completes it, so a collection nobody explicitly opened is closed.

Note the middle column. Operators quote and book all day and legitimately need the purchase price to judge a file, but they do not need to edit the grids or the customer margin rules that generate it. Cargavo, the TMS for freight brokers and transport commissionaires, separates those two permissions rather than treating "internal" as one bucket. The vocabulary is defined in the buy rate and sell rate glossary entries.

Work the example end to end. A shipment of 780 kg chargeable weight goes out on a weight_zone grid, zone FR-3, in the 500-999 kg bracket priced at €18.40 per 100 kg.

• Line haul: 7.80 × €18.40 = €143.52
• Indexed fuel surcharge at 12.5%: €17.94
• Total buy price p: €161.46
• Sell price at a 22% target margin, p/(1-m): €161.46 / 0.78 = €207.00

Gross profit is €45.54, and €45.54 / €207.00 confirms 22.0%. Now assume one carrier invoice reaches the shipper — misdirected email, a rate printed on delivery paperwork, a former employee. The shipper computes €207.00 / €161.46 = 1.2822 and has your coefficient. Every past and future quote priced by the same rule is now transparent, and they will open the next negotiation with the number.

Two defences reduce the damage, and neither is secrecy.

Vary the rule. When margins are set per customer, per grid and per weight bracket, one leaked pair reveals one cell, not the book. A percentage on light brackets and an absolute amount on heavy ones breaks the ratio outright — the arithmetic is in percentage vs fixed margin rules.

Round the output. Publishing €207.00 hands over a figure divisible back to the cent. Round the sell price up to the nearest €5.00 and you publish €210.00, which is consistent with any true sell price above €205.00 and up to €210.00 — that is, any buy price from €159.90 to €163.80. The exact cost disappears into a €3.90 band, and you keep €3.00 of the ambiguity as profit. Cargavo, the TMS for freight brokers, applies configurable rounding at the end of the calculation for this reason; the margin arithmetic itself is covered in margin-safe freight quoting.

This is the risk nobody writes about, and it is inherent to instant quoting rather than to any product. Give a shipper a price simulator and you have given them an oracle: they can ask 400 kg, then 450 kg, then 500 kg, and watch where the price steps. Within an afternoon they know your bracket boundaries on that lane, and they can start declaring 495 kg instead of 505 kg.

Three things are worth separating, because they carry very different levels of confidentiality.

The first two rows are not worth defending. Weight breaks at 100, 300, 500 and 1,000 kg are close to industry convention, and a shipper who optimises pallet build to stay under a break is doing normal logistics work — your chargeable weight calculator tells them the same thing openly. The last three rows are the actual secret, and probing cannot reach them because they were never sent.

Two practical guards remain. Put the simulator behind a named portal login rather than a public page, so quoting activity is attributable to an account. And avoid showing the carrier name to the customer: knowing which haulier moves the freight is the fastest route to a shipper calling that haulier directly. Cargavo, the TMS for freight brokers and transport commissionaires, runs the customer simulator under the broker's own brand, with carrier selection kept broker-side — see the customer quote portal guide.

Once prices are computed server-side and financials are permission-separated, the remaining exposure is entirely human and entirely file-shaped. These are the vectors that actually occur, in rough order of frequency.

Two of these deserve a comment. A PDF produced by printing an internal quote screen is dangerous even when the margin line is scrolled out of view, because a PDF stores text objects, not a photograph — text placed outside the visible area, or covered by a white rectangle, is still selectable and still searchable. If you export quotes to PDF, generate them from the same restricted data the portal uses, not from the broker screen with fields toggled off.

The carrier row is the one brokers forget. Your architecture cannot control what a haulier prints on a CMR or leaves in the cab, and a rate visible at delivery hands the shipper the pair described earlier in this guide. Raise it during onboarding, alongside the other paperwork questions in the carrier onboarding checklist. Cargavo, the TMS for freight brokers, keeps quote and shipment messaging in per-customer threads precisely so that a carrier conversation cannot be forwarded into a customer one by reflex.

An audit takes under an hour and is worth repeating whenever quoting software, templates or export formats change.

1. Create a portal login for a test customer with no special privileges.
2. Request a quote from that session and note the price returned.
3. Open the browser network log and confirm no carrier rate, grid or margin appears in any response.
4. Retrieve the quote record directly from that session and confirm the financial fields are refused, not merely absent from the screen.
5. Export or email the quote exactly as a customer would receive it, then search the file for the buy figure.
6. Ask a colleague to send you a quote by their normal method, and check the attachment, the thread and the file metadata.
7. Re-price three recent shipments and confirm the sell prices match what the customer was told.

Step four is the one that fails most often, and step five is the one that fails most expensively. Step seven catches the opposite error — a margin quietly applied twice, or not at all.

One caveat on the whole subject. Hiding the buy rate is the default commercial posture, not a universal rule: some shippers contract on an open-book or cost-plus basis and are entitled by contract to see the carrier rate and a stated management fee. That is a pricing decision, and it belongs in the customer record rather than in an ad-hoc email. A system that separates the two by permission can serve both models; a spreadsheet cannot serve either reliably.

Cargavo, the TMS for freight brokers and transport commissionaires, publishes its plans at €49, €149 and €399 per month with a 14-day free trial and no credit card, so this audit can be run on a real portal before any commitment — the plan detail is on the pricing page.