Security & compliance
What protects driver data inside Sakshya, what protects this website, where our compliance posture genuinely stands — and how to report a vulnerability to us.
1. Why this page exists
Telematics fails on trust before it fails on technology. An insurer’s procurement team, a fleet’s IT function and a driver’s union will all ask the same question in different words: who can see this data, and what stops it leaking? This page answers that in public, so the conversation can start from evidence.
Controls described as shipped are running in production. Where something is planned rather than done, it says so.
2. Platform security controls
Identity and access
- Biometric sign-in on the driver app; two-factor authentication on the fleet console.
- Role-based access control across org admin, safety manager, dispatcher and analyst roles — acknowledge and resolve actions are denied to read-only analysts.
- The platform-admin console is a separate, IP-fenced surface with single sign-on through Keycloak / OIDC, used only by AIABS operators.
- A web-application-firewall authentication-flood penalty box throttles credential-stuffing attempts.
Device and client integrity
- Device integrity attestation (Play Integrity on Android, App Attest on iOS) so the backend can distinguish a genuine app on a genuine device from a repackaged client.
- Encrypted local storage for the on-device trip queue.
- A signed, fail-closed remote-configuration channel using Ed25519 signatures — an unsigned or invalid configuration is refused rather than applied, so nobody can push a malicious config to a fleet.
Data handling
- The insurer partner API is served through a JWT scoped to insurer data sharing and never returns raw location. A legacy unscoped endpoint was found during our own audit and removed.
- Per-read access logging — every manager read of a driver’s data is recorded and is visible to that driver.
- Uploaded attachments and voice notes are scanned server-side for malware before any download is permitted.
- The public SOS tracking link is served from the app domain, never the API domain, so the API host is not exposed to the public internet through that feature.
Engineering and operations
- Continuous-integration gates enforce the consent predicate and the erasure sweep: a build fails if a new table escapes the right-to-erasure cascade, or if a surface checks consent differently.
- One-command deploys with automatic rollback, monitored to a single paging path.
- A system health dashboard, an audit trail and a breach register maintained inside the platform-admin console.
3. This website
The site is a static, self-contained deployment with a deliberately small attack surface:
- No third-party scripts, no analytics, no cookies, no advertising or tracking pixels.
- Fonts are self-hosted, so rendering a page does not disclose your IP address to a font provider.
- HTTP Strict Transport Security with a one-year max-age,
includeSubDomainsand preload. - A Content Security Policy restricting scripts, styles, fonts, images, connections and form actions to known origins.
X-Content-Type-Options: nosniff,X-Frame-Options: DENYandframe-ancestors 'none',Referrer-Policy: strict-origin-when-cross-origin.- A restrictive
Permissions-Policydisabling camera, microphone, geolocation, sensors, payment, USB and interest-cohort APIs. - Cross-origin opener, embedder and resource policies set to isolate the origin.
4. Compliance posture
| Area | Status | Detail |
|---|---|---|
| DPDP Act, 2023 (India) | Built into the product | Consent-first architecture, granular and revocable and expiring consent, data export, right-to-erasure across 37 tables with a CI gate, driver-visible access history, and a named grievance contact. |
| GDPR alignment | Design-aligned | Data minimisation, purpose limitation, processor transparency and data-subject rights are implemented; formal EU representation is not applicable while operations are India-first. |
| AIS-140 (India) | Alternative approach | Sakshya is software-first and does not certify as an AIS-140 device. Where a mandate requires certified hardware, a Tier 3 tag composes into the same scoring engine. |
| External penetration test | Planned | An independent penetration test and DPDP-aligned data-protection audit are funded milestones in the current round, not completed work. We will not claim otherwise. |
| Formal certifications (e.g. ISO 27001, SOC 2) | Not held | We do not hold these today. Enterprise and insurer procurement certifications are budgeted in the current round. |
5. Responsible disclosure
We welcome reports from security researchers and we will not pursue legal action against anyone who follows this policy in good faith.
How to report
Use the contact form and select “Security vulnerability report” as the subject — that is our designated intake for disclosures. Please include the affected asset, reproduction steps, the impact you believe it has, and any proof-of-concept, and please do not include third-party personal data in your report. If a report is too sensitive for a web form, say so in one line and we will send you an encrypted channel.
What we commit to
- Acknowledge your report within 3 working days.
- Give you an initial assessment and a remediation plan within 14 working days.
- Keep you updated until the issue is resolved, and credit you publicly if you would like that.
What we ask
- Give us reasonable time to fix an issue before disclosing it publicly.
- Do not access, modify or delete data that is not yours; use your own test accounts.
- Do not run denial-of-service, spam, social-engineering or physical attacks against us, our staff or our customers.
- Do not pivot into third-party services we depend on.
We do not currently operate a paid bug-bounty programme. That is a statement of fact, not of how much we value the report.
6. Incidents
We maintain a breach register inside the platform-admin console. If a personal-data breach occurs that is likely to affect you, we will notify the Data Protection Board of India and affected Data Principals as required by the DPDP Act, and we will notify affected enterprise customers under their agreement — with what happened, what data was involved, what we did, and what you should do.
Security questions from procurement teams, and requests for our security questionnaire responses, go through the contact form under “Security vulnerability report”.