Security Practices
ATXfleetOS hosts payroll, HR, maintenance, and location data for trucking fleets — we treat that responsibility seriously. This page describes the security measures actually in place today, in plain language. We only claim what we run: no method is 100% secure, and we don't list certifications we don't hold.
Tenant isolation
- One database per customer. Each customer's data lives in its own database file; each customer's application process only has access to its own database, enforced at process startup.
- Per-customer subdomains with separate TLS certificates and separate session secrets — a session token from one tenant is useless on another.
- Customer media is stored in per-tenant buckets with per-tenant scoped access keys and CORS locked to that tenant's own domain.
Access control
- Two-factor authentication is mandatory for every user account — not optional.
- Granular role-based access control: an 84-permission catalog, deny-by-default; what a role isn't granted, it can't see or call.
- Application audit logging of security-relevant actions (logins, permission changes, data events) with timestamps and IP addresses.
- Vendor-side access to customer data is limited to a small number of people who operate the platform, via key-based administrative access.
Infrastructure
- All traffic is encrypted in transit with TLS; the marketing site enforces HSTS and a restrictive Content-Security-Policy.
- Hosting in a United States datacenter (Boston, MA); database services for messaging features run in AWS us-east-1, where the provider encrypts data at rest.
- Server hardening: SSH is key-only (password login disabled), firewall allows only web and administrative ports, fail2ban blocks brute-force attempts, and automatic security updates are enabled.
- Server-side malware monitoring runs on the host.
- Versioned, snapshot-based releases with rollback — deployments don't mutate running code in place.
Backups & continuity
- Nightly hot snapshots of every customer database, retained 30 days.
- Offsite copies to two independent destinations (Backblaze B2 in the US-East region, and Google Drive), transferred over encrypted connections.
- We have tested restoring from these backups — a backup you can't restore from doesn't count.
Reporting a vulnerability
If you believe you've found a security issue, email hello@atxfleetos.com with the subject line "Security". We'll acknowledge within 2 business days. Please don't test against production tenants — write to us and we'll set up a safe environment.
On the roadmap
These items are planned, not yet in place: at-rest encryption for primary application databases, server-side session revocation, and a formal SOC 2 program as the customer base grows. We answer security questionnaires honestly at hello@atxfleetos.com — see also our subprocessor list and Privacy Policy.