Trust

Security at FleetRails

We protect your operation like it's our own. Cloud-native, tenant-isolated, continuously tested.

Quick Summary

Infrastructure & Network

• Hosting: Enterprise-grade cloud infrastructure with data residency in Africa or the EU — your choice at workspace creation
• Network: Isolated private network; databases, caches, and internal services are never internet-routable
• Edge: Web application firewall with managed rules and custom rate limits
• DNS: DNSSEC with CAA records restricting certificate issuance
• Certificates: Managed TLS 1.2+ only; HSTS preload on all endpoints

Data Protection

Encryption

• In transit: TLS 1.2+ (1.3 preferred), with encrypted service-to-service traffic internally
• At rest: AES-256 encryption (managed keys) across databases, object storage, disks, caches and backups
• Secrets: Dedicated secrets manager for API keys, webhook signing keys and payment credentials — envelope encryption
• Key rotation: Automatic annual rotation of master keys; application keys rotated quarterly

Tenant Isolation

• Each workspace gets a dedicated database schema, dedicated object-storage space and dedicated cache — never shared tables
• Row-level security policies as defense-in-depth
• No cross-tenant queries possible at the application layer
• Subdomain routing enforces workspace boundary at the edge

Backup & Recovery

• Automated snapshots: daily, plus point-in-time recovery (7-day retention)
• Cross-region replica in an alternate region (async, under 5-minute recovery point)
• Monthly restore drills — verified by engineering
• Customer-initiated exports: CSV/JSON/API anytime

Access Control

Authentication

• Email/password with bcrypt (cost 12)
• TOTP 2FA (Google Authenticator, Authy, 1Password, etc.) — optional today, mandatory for admins on Pro (roadmap)
• Session cookies: Secure, HttpOnly, SameSite=Lax, 12-hour idle timeout
• API keys: scoped to workspace, rotatable, last-used visible in console

Authorization (RBAC)

Role	Scope	Key Permissions
Owner	Workspace	Everything — billing, team, settings, danger zone
Admin	Workspace	All ops, team management, settings (no billing)
Dispatcher	Assigned zones	Create/assign shipments, re-plan, view tracking
Warehouse Manager	Assigned depots	Receive, put-away, pick, cycle count, inventory
Finance	Workspace	Wallets, payouts, invoices, settlement, reports
Support	Workspace	Read-only + customer comms, disputes
Rider (mobile)	Assigned jobs	View jobs, navigate, POD, earnings

Approval Workflows

Sensitive actions require a second authorised user:

• Rider payout runs
• Customer refunds > ₦10,000
• Wallet top-ups > ₦100,000
• Tariff changes affecting live shipments
• User role changes (Admin/Owner)

All approvals logged in immutable audit trail.

Application Security

• Code scanning: Static and dynamic analysis on every change before it ships
• Dependencies: Continuously scanned; security fixes prioritised by severity
• Secrets scanning: Automated checks in CI plus pre-commit hooks
• Content Security Policy: Strict CSP on all web responses
• CORS: Allowlist per workspace (configured in console)
• Rate limiting: 120 req/min per API key; adaptive limits on auth endpoints

Vulnerability Management

• Bug bounty: Private program with tiered rewards (up to ₦2,000,000)
• Annual pentest: Independent certified firm; report summary shared with Pro customers under NDA
• Patch cadence: Critical CVEs ≤ 48 hrs; High ≤ 7 days; Medium/Low ≤ 30 days
• Disclosure: Coordinated via security@fleetrails.com (PGP key on request)

Compliance & Certifications

Standard	Status	Notes
NDPR (Nigeria Data Protection Regulation)	Compliant	DPIA completed; DPO appointed
GDPR	Aligned	EU region available; SCCs for subprocessors
PCI DSS	SAQ A	Our payment provider handles card data; we never touch PAN
SOC 2 Type II	In progress	Target 2027; Type I audit Q4 2026
ISO 27001	Planned	Post-SOC 2

Incident Response

• Detection: Infrastructure monitoring, error tracking and customer reports
• Triage: 24/7 on-call engineer (15-min acknowledgement SLA for Sev-1)
• Communication: Status page updated within 30 min; direct notification for affected workspaces
• Resolution: Fix → verify → deploy (canary → full)
• Post-mortem: Blameless, published within 5 business days for Sev-1/2
• Retention: Incident records kept 3 years

Security Headers (All Responses)

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://api.fleetrails.com https://sandbox.api.fleetrails.com wss://api.fleetrails.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin

Subprocessors (Security-Relevant)

• Cloud infrastructure — hosting, databases and storage (SOC 2, ISO 27001, PCI DSS)
• Payment processing — card, transfer and USSD (PCI DSS Level 1)
• Messaging — WhatsApp/SMS delivery (SOC 2, ISO 27001)
• Transactional email — delivery infrastructure (SOC 2, ISO 27001)
• Observability — metrics, logs and traces (SOC 2, ISO 27001; no personal data ingested)
• Error tracking — crash reports (SOC 2; personal data scrubbed before upload)

Named vendor list with DPAs available on request at privacy@fleetrails.com, and to Pro customers under NDA.

Security Contact

Report vulnerabilities: security@fleetrails.com
PGP key: https://fleetrails.com/.well-known/pgp-key
We acknowledge within 24 hours, triage within 72 hours.

Customer Security Addendum

Pro plan customers can request our Security Addendum (contractual commitments on encryption, access control, incident notification, audit rights). Email legal@fleetrails.com.

Security is a process, not a checklist. We invest continuously — this page reflects our posture as of 2026-09-07. For the latest, check status.fleetrails.com or email us.