Your operation runs on it.
We secure it that way.

Control domain

Data encryption

Every connection to FleetPath is encrypted, and sensitive stored data is protected at rest.

In transit

All public surfaces terminate TLS and enforce TLS 1.2 or higher. There is no plaintext listener. Transport encryption is enforced by the managed edge and hosting platforms that front the service.

At rest

The databases and file storage that hold your operational records run on managed cloud platforms that provide storage-level encryption at rest. On top of that, the most sensitive secrets we hold, your third-party integration credentials such as API keys and access tokens, are encrypted a second time at the application layer using authenticated symmetric encryption, under a server-side key kept separate from the data, with masked display and key-rotation metadata.

On the roadmap. We are adding application-layer field-level encryption for a small set of restricted direct identifiers, such as driver's license and taxpayer identification numbers, as an additional layer of defense in depth beyond platform encryption at rest. This is planned work, not yet in place.

Control domain

Tenant isolation

FleetPath is a multi-tenant platform built on PostgreSQL. Every carrier organization is a separate tenant, and one tenant cannot read another tenant's data.

Isolation is enforced in more than one place. Every tenant-owned table carries a tenant identifier, and row-level security is enabled on every tenant-owned table for direct database access from the apps. HTTP APIs and background workers run with elevated privileges that bypass those policies, so they must apply the tenant filter themselves. Workers use a helper that automatically chains the tenant filter on select, update, and delete. A TypeScript helper exists for the same idea, but it is not wired into every handler yet. The outcome we engineer for is that one tenant cannot access another tenant's data; we do not claim that a forgotten filter is physically impossible on every service-role path.

As of today, row-level security is enabled on every tenant-owned table in production, and a continuous-integration guard blocks any new table from shipping without it.

Control domain

Access control

Access to your organization's data follows the principle of least privilege: people and automated processes get only the access they need to do their work.

• Role-based access control. A tenant-configurable permission resolver enforces role-scoped access. Sensitive permissions fail closed, denying access if the resolver cannot make a clean determination, and core owner and administrator protections cannot be revoked by misconfiguration.
• Authentication. Sign-in is handled by our identity provider, and FleetPath does not store user passwords. Multi-factor authentication using a time-based one-time passcode is available, with hashed single-use recovery codes and audited recovery flows.
• Credential protection. Third-party credentials you connect are encrypted at rest, shown only in masked form, and can be rotated.
• Audit logging of sensitive access. Every access to a stored credential is recorded with the tenant, provider, action, actor, address, and device. Significant actions across the platform are written to a canonical audit log, stamped with the actor and whether the actor was a person or an automated process.

Control domain

Financial integrity

Money math in FleetPath is deterministic and independently checked. Totals on statements, invoices, and settlements are computed with exact decimal arithmetic and hard-checked against their line items before any document is generated. A language model never produces a figure that lands on a financial document.

An append-only ledger of financial adjustments serves as the audit trail for money movement, so the history behind any balance can be reconstructed.

Control domain

Data lifecycle

Your data is yours. You can take it with you, and you can have it deleted.

Export

You can export your operational records in machine-readable form. If your agreement ends, you keep access to export your data for a defined window before deletion begins. A full-account export (JSON, CSV, and your stored documents) is available, alongside machine-readable exports across the product.

Deletion

Account deletion is a self-service, retention-aware flow. When you request deletion, a cancelable grace window (about thirty days) opens: the account stays intact and recoverable until that window ends. After the window, a retention-aware purge job is not on the current worker allowlist, so a deletion request stays pending until an operator enables it. Some record classes carry legal retention floors, for example DOT and FMCSA record-keeping and IFTA and tax periods, and any records under a legal hold are preserved. Those are retained in restricted form; we do not delete them on an automatic statutory clock, because the obligation is the carrier's and the period varies by jurisdiction. You may ask us to delete a retained class at any time. Transient processing artifacts (for example load-analyzer board photos) are swept on a short cycle measured in hours to days.

Control domain

Application security

Security is part of how we build and operate, not a bolt-on.

• Secret management. Secrets are kept out of source control and are scanned for. Error diagnostics are captured with credentials stripped before storage.
• Incident response. We maintain incident-response runbooks and a data-breach notification plan, along with secret-rotation and recovery runbooks. Our plan is to notify affected customers of a data breach promptly, within 72 hours of becoming aware of it.
• Change control. Database changes ship as reviewed, version-controlled migrations, and code-ownership review gates changes to sensitive paths.
• Recurring internal security reviews. We run recurring internal security audits, including a systematic adversarial vulnerability-hunt program that has produced real fixes across the platform.

Control domain

Infrastructure

FleetPath processes your data on cloud infrastructure located in the United States, and the service is operated from the United States. The subprocessors that handle personal data on our behalf are configured for United States processing. See our Subprocessors page for the current list of who touches what, and why.

Durable workflow orchestration provides retry and recovery for long-running operations, so work resumes rather than being lost if a component restarts.