How we protect your data
Security isn’t a checkbox for FleetIntel. Fleet operators share sensitive operational data. We treat it accordingly.
- AES-256 encryption at rest
- TLS 1.2+ in transit
- EU data residency
- Never trained on your data
Infrastructure & encryption
FleetIntel runs on Supabase’s EU-region infrastructure. Your data is stored in Europe and does not leave it.
EU data residency
All data is stored in Supabase’s EU West region. Routes, drivers, vehicles, fines: none of it leaves European infrastructure.
Encryption at rest
All data at rest is encrypted with AES-256. Every database record, stored file, and backup is encrypted before it touches disk.
Encryption in transit
All connections use TLS 1.2 or higher. HTTPS is enforced across every request between your browser, our servers, and our database.
Row-level security
Every table in our database has Row Level Security enforced at the database layer, not just the application layer. Your data is isolated at the query level.
Managed infrastructure
Our database infrastructure is managed by Supabase, which holds SOC 2 Type II certification. Their controls cover physical access, network security, and availability.
Automated backups
Backups run automatically via Supabase’s managed backup system. Point-in-time recovery is available, protecting against accidental data loss.
Frontend infrastructure
FleetIntel’s frontend application is built and hosted on Lovable. Their platform security controls extend to everything running on the frontend layer.
Lovable SOC 2 Type II
FleetIntel’s frontend is built on Lovable, which holds SOC 2 Type II certification. Their security controls cover the platform infrastructure, application layer, and deployment pipeline, independently verified by a third-party auditor.
Lovable ISO 27001
Lovable maintains ISO 27001 certification for information security management. This covers the platform FleetIntel’s frontend application runs on, including access controls, incident management, and operational security.
Automated code scanning
Lovable automatically scans generated code, dependency trees, and database configurations for known vulnerabilities and unsafe settings. Findings are categorised by severity and surfaced before deployment.
No training on your code or prompts
Lovable does not use customer prompts, code, or workspace data to train models. Contractual agreements with their AI sub-processors restrict both training and retention of customer data.
EU data residency
Lovable Cloud supports regional data hosting including the EU. Customer data remains in the selected region by default and does not move across regions without explicit configuration.
Workspace isolation
Each Lovable workspace and project is logically separated at both application and infrastructure layers. Customer data is not accessible across accounts. Environment boundaries are explicitly enforced before changes are published.
Full details available at lovable.dev/security
Access control
Who can see what is enforced at every layer, from the database up to the interface.
Account isolation
Each fleet account is fully isolated. No user can access another organisation’s data. Enforced at the database level through Row Level Security policies, not application logic alone.
Authenticated API access
All API requests require a valid authenticated session token. Unauthenticated requests are rejected before reaching any data layer. Tokens expire and rotate automatically.
Multi-factor authentication
MFA enforcement for all user accounts is on the roadmap. When available, it will be configurable at the account level with support for authenticator apps.
SSO / SAML
Single sign-on via SAML will be available for operators who need to authenticate through an existing identity provider: Okta, Azure AD, and others.
Audit logs
Full workspace event logs (who accessed what, when, from where) will be available for compliance-conscious fleet operators and enterprise accounts.
AI & data governance
FleetIntel uses AI to power its compliance agents. Here is exactly how your data is handled during AI processing.
Never trained on your data
We maintain a strict policy against using customer data to train or improve any AI model, ours or our providers’. Your operational data is used to answer your query and nothing else.
Zero retention by our AI provider
FleetIntel uses the Anthropic Claude API with zero data retention. Inputs and outputs are not stored by Anthropic beyond the immediate request. Nothing is logged, retained, or used for model training.
Isolated processing
All AI requests are transmitted individually through SSL-encrypted channels. Your data is never batched with other customers’ queries or shared across accounts.
Your data serves only you
All AI responses are strictly scoped to your account. No cross-customer data mixing occurs at any point in the processing pipeline.
Sub-processor compliance
Our AI sub-processor (Anthropic) maintains SOC 2 Type II compliance. Their security controls meet the same rigorous standards we hold for our own infrastructure.
Safety review before deployment
Every AI capability undergoes internal security and legal review before it is made available in the product. No experimental features reach production without that review.
Compliance
FleetIntel is built on EU infrastructure and operated under GDPR obligations. Additional certifications are in progress.
GDPR
FleetIntel is operated from the EU and stores all data in EU-region infrastructure. We process personal data only as necessary to provide the service, and data subjects have the right to access, correct, and delete their records.
Supabase SOC 2 Type II
Our database infrastructure provider holds SOC 2 Type II certification, independently verifying their security controls, availability commitments, and data handling practices.
SOC 2 Type II (FleetIntel)
An independent SOC 2 Type II audit of FleetIntel’s own systems and practices is planned as the product scales.
ISO 27001
Information security management system certification is on the roadmap for enterprise readiness.
Questions about security or data handling?
We’re happy to share further documentation or walk through our setup with your compliance team.