Home / Documentation / Security
Documentation 05
Stated as properties your own team can test, rather than as assurances.
Accounts belong to your organization and are administered by you. Second-factor authentication is supported by authenticator app and by passkey — Windows Hello, Touch ID or a hardware key — and can be required for privileged roles or for everyone, as your policy dictates.
Passkeys work with no internet connection, which matters on a site that has none.
Signing out ends the session on our server, not only in your browser, and anyone can sign out all of their other devices from their settings. Changing a password signs out every other session, because a password is usually changed when someone else may have it. Suspending a member ends all of their sessions at once, rather than leaving them working on the one they already had.
Where your policy requires a second factor, it is required wherever a session is issued: at sign-in, when someone accepts an invitation, and when they switch into another organization where their role requires one.
Devices authenticate with their own credentials, issued per facility or per unit and revocable individually. A scanner that goes missing is revoked without disturbing the rest, and a revoked credential stops working immediately rather than at the next renewal.
Operational actions are written to an append-only audit trail. The application itself holds no privilege to alter or delete those entries — a deliberate arrangement, because an audit trail that the application can edit is an audit trail an attacker who reaches the application can edit. Entries are kept for a year by default, then removed by a recorded, verifiable process.
Entries record who acted, when, and on which record — including actions taken by a party acting on your behalf, which remain attributed to the individual rather than to the agency.
For operational records (shipments, custody, documents, stock, orders and the rest), separation is enforced in the database rather than in application code, so a defect in a feature cannot leak another organization's records: an unscoped query returns nothing instead of returning everything. Accounts, sign-in sessions, keys and billing are looked up before an organization is known, so the application keeps those apart. Sensitive material a customer entrusts to us — the credentials for your own telematics account, for example — is encrypted at rest and never returned by any interface, only replaced.
For customers working under export-control or similar regulatory obligations, the relevant controls are access control, audit, identification and authentication, and protection of data at rest — and the air-gapped deployment exists precisely so that the system boundary can be drawn where your assessor needs it.
We will not claim a certification we do not hold. If your program requires evidence against a specific control set, ask, and you will get a straight answer about what is in place today and what would be work.
The Deployment Architecture (PDF) sets out the tenancy model, the air-gap control and how your team can test it, and what we do not claim.
