Security Practices
Last updated: May 3, 2026
Your fleet data — vehicle records, driver information, compliance documents, and operational history — is sensitive. Here is exactly how Fleiko protects it.
Infrastructure
🏗️Hosting
The Fleiko portal is hosted on Vercel (edge network, US regions). All compute runs inside Vercel's managed infrastructure, which includes DDoS protection, automatic TLS provisioning, and global edge caching.
🗄️Database and Authentication
All data is stored in Supabase, a managed Postgres platform running on AWS infrastructure in the United States. Supabase handles database hosting, authentication, and file storage. Row-level security (RLS) policies are enforced at the database layer — every query is scoped to the authenticated company, preventing cross-tenant data access.
📁File Storage
Uploaded documents (registrations, insurance certificates, inspection reports) are stored in Supabase Storage with object-level access controls. Files are not publicly accessible — retrieval requires an authenticated session with access to the relevant company account.
Encryption
- In transit: All data transmitted between your browser and Fleiko is encrypted using TLS 1.2 or higher. HTTPS is enforced on all routes — there is no plain HTTP access.
- At rest: Data stored in Supabase (database and file storage) is encrypted at rest using AES-256, managed by AWS.
- Passwords: User passwords are never stored by Fleiko. Authentication is handled entirely by Supabase Auth, which uses bcrypt hashing. Fleiko staff cannot retrieve or view any user's password.
Access Controls
- Tenant isolation: Every API request is authenticated and scoped to the requesting company. It is architecturally impossible for one company's data to appear in another company's portal view.
- Role-based access: Portal users are assigned roles (owner, manager, driver). Drivers have restricted access — they cannot view company financials, reports, or other companies' records. Report access requires manager-level or higher.
- Admin access: Fleiko's internal admin panel is protected by a separate authentication system. Only authorized Fleiko staff can access it. Admin access to client data is restricted to what is necessary for support purposes and is logged.
- Session security: Sessions are managed by Supabase Auth with secure, httpOnly cookies. Sessions expire automatically after inactivity.
Backups and Data Integrity
- Automated backups: Supabase performs daily automated backups of the database with point-in-time recovery. Backups are retained for 7 days on the base plan.
- Audit logging: Key operations (document uploads, status changes, user invites) are logged with timestamps and user identifiers.
- Data export: You can export your operational data at any time through the portal or by contacting support. On account cancellation, you have a 30-day window to export all data before it is deleted.
Third-Party Sub-Processors
Fleiko uses the following sub-processors. Each is contractually bound to protect your data:
| Provider | Role | Data Processed | Location |
|---|---|---|---|
| Supabase | Database, authentication and file storage | All fleet and user data | United States (AWS) |
| Vercel | Web hosting, edge network and product analytics | Request logs, IP addresses, page-view events | United States |
| Resend | Transactional email delivery | Email address, message content | United States |
| Twilio | SMS delivery and inbound SMS handling | Customer and driver phone number, message content, delivery status | United States |
| Route ETAs, route optimization, and driver push delivery | Driver's live GPS coordinates and job service coordinates (route ETA and optimization); device push token, notification title and body (push) | United States | |
| Apple | Driver web push delivery (Apple Push Service, when web push is enabled) | Push subscription endpoint, notification title and body | United States |
| Mozilla | Driver web push delivery (Mozilla Push Service, when web push is enabled) | Push subscription endpoint, notification title and body | United States |
| hCaptcha | Bot protection on signup and login | IP address, browser and interaction signals from the sign-in form | United States |
| Stripe | Subscription billing and payment processing | Billing contact, payment method, subscription and invoice records | United States |
| Anthropic | AI assistant (Fleiko Copilot) | The fleet context sent with each Copilot message — vehicle, driver, maintenance, document and cost records | United States |
| Sentry | Error monitoring | Error reports, which may include the signed-in user id and request metadata | United States |
| Upstash | Rate limiting | IP addresses (hashed) | United States |
| Mapbox | Map rendering (fleet tracking and dispatch views) | Vehicle and job coordinates | United States |
Vulnerability and Incident Response
- Breach notification: If Fleiko discovers a security incident that affects your data, we will notify you within 72 hours of becoming aware of it, consistent with GDPR Article 33 and US state breach notification laws.
- Input validation: All API endpoints validate and sanitize inputs. Database queries use parameterized statements — SQL injection is not possible through the application layer.
- Dependency management: Third-party packages are kept up to date and reviewed for known vulnerabilities.
- Reporting a vulnerability: If you discover a security issue, please report it responsibly to legal@fleiko.com. Do not publish vulnerability details publicly before giving us reasonable time to respond.
What We Do Not Do
- We do not sell, rent, or share your data with third parties for marketing or advertising purposes.
- We do not collect real-time vehicle location or GPS data.
- We do not integrate with ELDs or ingest hours-of-service records.
- We do not have access to your drivers' devices.
- We do not retain your data after the 30-day post-cancellation export window.
Your Responsibilities
Security is a shared responsibility. To keep your account secure:
- Use a strong, unique password for your Fleiko account.
- Do not share login credentials between team members — invite each user individually so access can be revoked independently.
- Remove access promptly when an employee leaves your organization.
- Contact us immediately at legal@fleiko.com if you suspect unauthorized access to your account.
Security questions or concerns? Email legal@fleiko.com. We take security reports seriously and will respond within 2 business days.