Enterprise-grade access, built in

Encryption in transit

Connections to our website, apps and APIs are encrypted with TLS (HTTPS).

Encryption at rest

Uploaded documents are encrypted with managed keys, backups are encrypted, and authenticator-app secrets are encrypted in our database.

Password protection

Passwords are kept only as Argon2id hashes — never in a form that can be reversed — and earlier ones are kept the same way so they cannot be reused.

Multi-factor authentication

Authenticator-app (TOTP) codes, with hashed single-use recovery codes. Mandatory for administrators; organisations can require it for everyone.

Session limits

Access tokens expire after 60 minutes, and every session ends within 90 days.

Access control

Role-based permissions, which can limit a user to particular vehicles.

Customer separation

Each customer’s data is kept apart from every other customer’s, enforced in the database itself.

Audit trail

Security and data-change events are recorded append-only — who acted and on whose behalf, what they did, when, and from which IP address.

Recorded support access

When our support team needs to see a customer’s workspace, they use a dedicated support-access tool, and every session is recorded.

Organisational measures

Need-to-know access

Our staff access personal information only where their role requires it.

Supplier safeguards

We use providers that commit to protecting data, and bind them to that by contract.

Incident response

We investigate suspected breaches promptly, and notify the people affected and regulators where the law requires.

Where your data lives. Our platform — its database, files and backups — is hosted by Amazon Web Services in Mumbai, India. Our website and web apps are served by Google Firebase.