Security and privacy: only what we can stand behind

Your data belongs to your company

Each organization sees only its own data: every query is filtered by the company of the signed-in user, and automated tests check it.

• Owner, manager, read-only and operator roles
• Per-field permissions for people who work with fields
• Removing a user takes effect on their next request

Protected access

Passwords are stored with a strong hash (argon2id), never in clear text, and the web app uses cookies that the browser won’t let JavaScript read.

• Connections encrypted with HTTPS
• Limits on sign-in attempts
• Sign out of your other devices from your profile

Devices under control

Each phone or tablet is enrolled with a code that expires and works with short-lived credentials that renew with rotation and reuse detection.

• An owner or manager can revoke a device
• The app’s secrets are kept in the Android Keystore
• A network or authentication error never deletes saved points

People have rights

A driver’s location is personal data. Fleetrak records their consent when the device is enrolled and gives you tools to respect it.

• Consent recorded per device
• Configurable retention: you decide how many days location is kept
• The owner can export and delete each vehicle’s data

Audit log

Accesses and important changes are kept in an audit log, including exports and deletions of a vehicle’s data.

What we can’t claim yet

We are a young product and we prefer to be clear about the limits.

• We hold no third-party security certifications
• We have not yet verified encryption of the data stored on disk
• The terms and privacy policy are a draft pending legal review
• We keep hardening the service: each internal review produces improvements that are applied in order of risk