Data Protection & Security
Your trips, money and drivers’ details are business-critical. This page explains how FleetLite protects them.
Last updated:
In short
- Each company’s data is isolated in its own database, never mixed with another company’s.
- Everything travels over HTTPS / TLS, and backups and sensitive fields are encrypted.
- Databases and files are backed up every night, encrypted, to a separate data centre.
- Roles, branch access and audit logs control and record who does what.
- If a breach affects your data, we tell you without delay and report it as the law requires.
On this page
1. Each company’s data is isolated
Every company’s operational data (vehicles, drivers, trips, money, documents) is held in its own separate database, isolated from every other company’s. Each request is answered from the signed-in company’s own database connection, and tests check that one company can never read another’s data.
If we change how databases are hosted (for example grouping very small fleets on shared database servers), each company’s data stays isolated and reachable only through that company’s own connection. The central system holds only accounts, subscriptions and billing totals.
2. Encryption
- In transit: the website, web app, mobile apps and API are served only over HTTPS / TLS.
- At rest: backups of databases and files are encrypted before they leave the server. Smart Capture raw messages, database passwords and integration keys are encrypted with AES-GCM.
- Passwords are stored only as salted hashes; we can never see them.
- Files (bill photos, documents, proof of delivery) are stored privately and opened through short-lived signed links.
3. Backups
Every company database and every stored file is backed up each night, encrypted, to a separate data centre of our hosting provider (off-site). Backups are kept for a rolling 30 days, and restores are tested.
4. Access control inside your company
- Roles (Owner, Manager, Accountant, Data entry, Supervisor, Driver and others) with a permission grid per module: view, add, edit, delete.
- Branch access, and profit hidden from staff who should not see it.
- Sign-in with OTP or password, with limited attempts; drivers see only their own vehicle, trips and account.
- Switch a user off and their access ends at once.
5. Audit logs
Every create, update and delete on financial records (trips, expenses, invoices, payments, ledgers) is written to an append-only audit log with who, when and what changed. Every action in our admin portal, including signing in to a company to help it, is audited too.
6. Our staff
Only the people at Marz Xpert Solutions Pvt Ltd, TechSlide IT Solutions Pvt Ltd and SyvaSoft Business Solution Pvt Ltd who need it to run or support the service can reach production systems. Admin sign-in uses two-factor authentication. Support access to a company account is time-limited and recorded, and everyone with access is bound by confidentiality.
7. Incidents and breach notification
If we detect a security incident we contain it, investigate it and fix the cause. If a personal data breach affects your company, we tell the owner without undue delay with what happened, what data was affected and what we are doing. We report breaches to the Data Protection Board of India and to CERT-In as and when the law requires.
8. Data export and deletion
Owners can export their data at any time as Excel and PDF. After cancellation, data can be exported for 30 days and is permanently deleted after 90 days. See the Cancellation Policy and Delete your account.
9. Responsible disclosure
Found a security problem? Email sales@syvasoft.com with the subject “Security report”, the steps to reproduce it and its impact. Please do not access other people’s data, disrupt the service or make the issue public before we have fixed it. We acknowledge reports within 3 working days and keep you updated.
10. Service status
A public status page is coming soon. Until then we announce planned maintenance and outages in the app and on WhatsApp.