Security
You are asking us to watch your vehicles, your cargo, and your drivers. Here is exactly how we protect that — written plainly, not buried in a PDF.
Full detail, sub-processors, and completed questionnaires are available under NDA on request.
AES-256
Encryption at rest
TLS 1.2+
Encryption in transit
MFA
Required for all staff access
30 days
Confirmed deletion requests
Controls
Six areas, and the specific mechanism in each. If you need detail on any one of these, ask — we will give you the technical answer rather than the brochure one.
All traffic between your devices, the API, and our platform runs over TLS 1.2 or higher. Data at rest — databases, backups, and stored video — is encrypted with AES-256. Credentials and secrets are held in a dedicated secrets manager, never in code or configuration files.
Customer data is visible only to staff whose role requires it. Access is authenticated with multi-factor authentication, granted on a least-privilege basis, and logged. Production access is time-limited and reviewed rather than standing.
The platform runs on auto-scaling cloud infrastructure with network segregation between environments. Production is never used as a testing environment, and production data is not copied into staging.
Backups are encrypted, retained on a rolling schedule, and — critically — restored on a schedule. A backup nobody has restored is a hypothesis, not a safeguard. We verify recovery regularly rather than trusting that the job reported success.
Systems are monitored continuously for anomalous access, unusual query volume, and failure conditions. Alerts route to on-call engineers. We run a defined incident process with severity levels, named owners, and post-incident reviews that produce tracked corrective actions.
We do not sell fleet data, share it with advertisers, or use it to train third-party models. One-click export in standard formats is available at any time — including after cancellation — so leaving is always possible and never punishing.
Engineering practice
Nothing glamorous here. This is the set of habits that keeps a platform handling live location data for other people’s businesses available and intact.
We welcome responsible security research. If you find a vulnerability in the platform, send the details and we will work on it properly.
Security FAQ
Yes. We complete standard vendor security questionnaires and are happy to sign a mutual NDA first if that comes before the paperwork. Send the questionnaire to our address and we will turn it around.
Yes, on enterprise agreements. Dedicated allocation and isolated tenancy are available where your compliance requirements need them — discuss this during the quote so it is costed correctly.
We follow a defined incident process: contain, assess, remediate, then notify. Where your data is affected we will tell you what happened, what data was involved, and what we have changed to prevent it recurring — in plain language, and without waiting for every detail to be perfect.
Email info@axiontrack.com with the details. We acknowledge reports within two business days and will keep you updated as we work on it. We do not take legal action against researchers who act in good faith, stay within our systems, and give us reasonable time to fix before disclosure.
On cloud infrastructure we operate, in-region where commercially and technically available. Your precise hosting location, sub-processors, and data residency options are documented in your order — ask us and we will tell you exactly rather than being vague about it.
That is your responsibility as the data controller, and we give you the tools to handle it properly: scoped user permissions, configurable retention, and export for subject access requests. We are happy to advise on notice wording and consent flows for driver monitoring.
Due diligence
Send us your security questionnaire or request the full pack. We will also happily put an NDA in place first. Email info@axiontrack.com or ask below.
Prefer to talk first? Message us on WhatsApp · 0322-4644489
