Security and data protection
Security and data protection in MobilityDrive
How MobilityDrive keeps a transport company's bookings, passengers, drivers and invoices apart from every other company's, who can see what, how secrets and files are stored, and what we do not claim. Written for the operator, and for the corporate client's procurement team who will ask.
Is MobilityDrive secure?
MobilityDrive encrypts traffic with TLS, keeps every company's data inside that company's own boundary, controls access with role-based permissions that are enforced on the server, stores integration secrets encrypted with AES-256-GCM and API keys only as hashes, serves private files through signed links that expire, and keeps an audit trail of who changed what. MobilityDrive is not ISO 27001 or SOC 2 certified and has not had an independent penetration test that we can show you, and we say so here instead of implying otherwise.
What is in the product
The controls that are built today
Encryption in transit
The website, the admin console, the corporate portal, the API and the three mobile apps talk over HTTPS with TLS. Nothing is sent in the clear between a browser or a phone and our server.
One company, one boundary
Every record carries the company it belongs to, and every query is scoped to the company of the signed-in user. One operator cannot see another operator's bookings, clients, drivers or invoices.
Role-based permissions
You decide what each role may see and do, module by module. The API checks the permission on every request in production, so hiding a menu is never the only thing that keeps a screen closed.
Secrets stored encrypted
Payment gateway, messaging, webhook and single sign-on secrets are encrypted with AES-256-GCM before they are stored. API keys are stored only as SHA-256 hashes, so a key is shown once when you create it and cannot be read back afterwards.
Private files behind signed links
Driving licences, vehicle papers, receipts and attachments are not served to anyone who has the address. A file opens only through a link the system has signed, and the link expires.
An audit trail you can check
Changes are written to an activity log with who made them and when. The entries are chained together by a hash, so an edited or deleted entry breaks the chain and the check reports it.
Fleet software security starts with who can sign in
Staff sign in to the admin console with an email address and a password, and passwords are stored as salted hashes, never as text. Drivers and passengers sign in to their apps with a one-time code sent to their phone. Sign-in attempts and one-time codes are rate limited for each person and for each network address, and an account is locked for a short time after repeated wrong passwords, so guessing is slow and noisy.
Your corporate clients can sign in to the booking portal with their own identity provider through single sign-on (OpenID Connect), so their staff use the accounts their own IT team already controls. Each role you create has its own permissions, and a person only ever sees the branches, clients and screens their role allows. The corporate client portal page describes the portal roles.
Data protection for passengers, drivers and employees
A transport company holds personal data about the people it carries and the people who drive for it. MobilityDrive has the working parts that India's Digital Personal Data Protection Act asks a company to keep: consent records, a register of data requests such as access, correction and erasure, a retention setting and a named grievance officer for your company. You remain responsible for your passengers' and drivers' data, and we process it on your behalf.
You can take your own data out at any time: an export produces every table of your company's data as CSV files in one ZIP. The data is stored on a server in India. The database is backed up before every release. Each mobile app has its own privacy notice, which says what the app collects and how a person asks for deletion: see the Driver app, Customer app and Dispatcher app notices, and our Privacy Policy for this website.
At a glance
What is in place, and what is not
| Area | What is in place | What we do not claim |
|---|---|---|
| Encryption | TLS in transit for the website, the admin console, the portal, the API and the apps; integration secrets encrypted with AES-256-GCM | We do not claim that every database field is encrypted at rest |
| Access | Role-based permissions enforced on the server, rate limits on sign-in and one-time codes, single sign-on (OpenID Connect) for the corporate portal | Two-step sign-in with an authenticator app for staff is not built yet |
| Separation | Every record and every query is scoped to one company | A separate database or server for each company is not part of the standard setup |
| Records | A hash-chained activity log, consent records and a data request register | The log is not a certified or externally audited record |
| Integrations | API keys stored as hashes, scopes and an expiry date per key, signed webhook deliveries | No third party has certified the API |
| Assurance | The controls on this page, which we will walk through with your IT team | No ISO 27001 or SOC 2 certificate, no independent penetration test report, and no published uptime figure |
Integrations, API keys and webhooks
When you connect a payment gateway, an SMS or WhatsApp account, a flight data provider or an e-invoice connector, you use your own account with that provider, and the secret you paste in is encrypted before it is stored. An API key you create for your website or another system carries only the scopes you give it and can be given an expiry date, and each webhook delivery is signed so the receiving system can check it came from MobilityDrive. The integrations and API page lists what can be connected.
If your procurement team has a security questionnaire, send it to us before the demo and we will answer it line by line, including the points where the honest answer is not yet. You can book a demo and bring your IT team, or read the frequently asked questions first.
Security questions buyers ask
Is MobilityDrive ISO 27001 or SOC 2 certified?
- No. MobilityDrive is not ISO 27001 or SOC 2 certified, and we do not hold an independent penetration test report that we can share. The controls described on this page are built into the product, and we will go through them with your IT team.
Can one transport company see another company's data?
- No. Every record belongs to one company and every query is scoped to the company of the signed-in user, so an operator sees only its own bookings, clients, drivers, vehicles and invoices.
How are passwords, API keys and integration secrets stored?
- Passwords are stored as salted hashes. API keys are stored only as SHA-256 hashes and are shown once, when they are created. Payment gateway, messaging, webhook and single sign-on secrets are encrypted with AES-256-GCM before they are stored.
Where is the data stored?
- On a server in India. If your contract needs data to stay in another country, raise it with us before you sign, because it is not part of the standard setup.
Can we export or delete our data?
- Yes. An export produces every table of your company's data as CSV files in one ZIP. Requests from a passenger or a driver to see, correct or erase their data are logged in a data request register, and erasure is worked through with you case by case, because trip and invoice records may have to be kept by law.
Does MobilityDrive support single sign-on?
- Yes, for the corporate booking portal. A corporate client can sign in through its own identity provider with OpenID Connect. Staff of the transport company sign in to the admin console with an email address and a password.
Related pages
Bring your security questions to the demo
Send us your questionnaire first if you have one. We will answer every line, including where the answer is not yet.