Security and hosting: one server per brand.
Separation.
Between operators
Each operator has its own server, database, web address and tracker ports. No other operator's devices report to your ports, and no other operator's users can sign in to your portal.
Between your clients
Within your server, devices belong to accounts and users see only what has been assigned to them. API keys and webhooks follow the same rules, so a client's integration sees that client's vehicles alone.
Roles and restrictions.
Give each account the rights it needs. A restriction can be added to any user, staff or client, and changed later.
| Setting | Effect |
|---|---|
| Administrator | Full control of the server: settings, branding, all devices and users. |
| Manager | Creates and looks after users of their own, within the device limit you set. |
| Standard user | Works with the devices assigned to them. |
| Read-only | Can look at the data but cannot change anything. |
| Device read-only | Uses the platform but cannot edit device settings. |
| No commands | Cannot send commands, such as an engine cut, to a unit. |
| Expiry date | The account stops working on a set date, which suits trials and contractors. |
| Disabled | Blocks sign-in without deleting the account or its history. |
Credentials and records.
Passwords
Stored as bcrypt hashes. A forgotten password is reset through a link sent by email.
API keys
Shown once at creation and kept as SHA-256 hashes, so a copy of the database does not hand out working keys.
Audit log
Each successful change made in the portal or through the API is logged with who made it, when, from which IP address and with what result. Secrets are masked.
Tracker data
A record is acknowledged to the unit only once it is saved, so a database hiccup does not cost positions.
Video evidence
Dashcam originals are kept unaltered beside the branded copies that people watch and download.
Links
Sharing links expire at the time you set, and dispatch driver links use long random tokens.
What we look after
Free SSL certificates from Let's Encrypt for your addresses, renewed by us. Platform updates, backups of your data and the server's capacity as it fills. Card details for your plan with us stay with PayFast; we never see the number.
What stays with you
Your domain's DNS records, the devices and SIM cards, who you give accounts to and with which rights, and the agreements you make with your clients. The privacy policy covers what we do with personal data.
Security questions
Who has access to the machine my platform runs on?
We keep administrative access so we can apply updates, renew certificates and look after backups. Your staff and your clients reach the platform through the portal, the app and the API.
How are passwords and API keys stored?
Passwords are kept as bcrypt hashes. API keys are stored as SHA-256 hashes and shown in full once, when created, so a lost key is replaced rather than recovered.
Could another operator ever see my clients' data?
No. Operators do not share servers or databases. Inside your server, one client account's users cannot see another client's devices.
Related technical pages
Put it on your own server and try it.
Order online and your server is normally live the next day, with your domain and logo in place and the tracker ports open.