Access by role
Platform administrators, organization administrators, drivers, and passengers have distinct permissions. Server-side checks govern access.
Connected journeys.
Considered access.
Understand how Tracking protects accounts, controls access, and handles sensitive configuration.
Protected account access
Passwords are hashed with bcrypt. Sessions use HTTP-only cookies, with Secure cookies enabled in production.
Encrypted SMTP credentials
Saved SMTP passwords use AES-256-GCM encryption with a server-managed encryption key.
PROTECTION, EXPLAINED
Clear about what is protected.
Encryption in transit
Production deployments must configure TLS to protect web requests and live connections with HTTPS and WSS. Protection depends on the hosting configuration.
Encryption at rest
SMTP credentials are encrypted by the application. Database, disk, and backup encryption must be configured and verified by the hosting operator.
Server-processed location data
The service processes location updates to provide live maps, trip history, and arrival estimates. Tracking does not provide end-to-end encryption for this data.
Account lifecycle
Invitation and password reset flows use time-limited, one-time links. Organization administrators manage access for their team.
COMMON QUESTIONS
A little more clarity.
Who can see a live journey?
Authorized organization users and the passengers assigned to that journey, subject to server-side access checks.
Does Tracking store plaintext passwords?
Account passwords are hashed with bcrypt. SMTP passwords must be recoverable to send email, so they are encrypted separately using AES-256-GCM.
Is the entire system end-to-end encrypted?
No. The server processes tracking data to deliver the service. HTTPS and WSS protect transport when TLS is configured; storage encryption is a deployment responsibility.
FROM FIRST PICKUP TO LAST STOP
Bring your journeys
Bring your journeys
into focus.
Open your workspace ↗
Already invited? Sign in with your organization account.