How we protect your data
Security isn’t a checkbox for FleetIntel. Fleet operators share sensitive operational data. We treat it accordingly.
AES-256 encryption at restTLS 1.2+ in transitEU data residencyNever trained on your data
Infrastructure & encryption
FleetIntel runs on Supabase’s EU-region infrastructure. Your data is stored in Europe and does not leave it.
EU data residency
Live
All data is stored in Supabase’s EU West region. Routes, drivers, vehicles, fines — none of it leaves European infrastructure.
Encryption at rest
Live
All data at rest is encrypted with AES-256. Every database record, stored file, and backup is encrypted before it touches disk.
Encryption in transit
Live
All connections use TLS 1.2 or higher. HTTPS is enforced across every request between your browser, our servers, and our database.
Row-level security
Live
Every table in our database has Row Level Security enforced at the database layer — not just the application layer. Your data is isolated at the query level.
Managed infrastructure
Via Supabase
Our database infrastructure is managed by Supabase, which holds SOC 2 Type II certification. Their controls cover physical access, network security, and availability.
Automated backups
Via Supabase
Backups run automatically via Supabase’s managed backup system. Point-in-time recovery is available, protecting against accidental data loss.
Frontend infrastructure
FleetIntel’s frontend application is built and hosted on Lovable. Their platform security controls extend to everything running on the frontend layer.
Lovable SOC 2 Type II
Via Lovable
FleetIntel’s frontend is built on Lovable, which holds SOC 2 Type II certification. Their security controls cover the platform infrastructure, application layer, and deployment pipeline — independently verified by a third-party auditor.
Lovable ISO 27001
Via Lovable
Lovable maintains ISO 27001 certification for information security management. This covers the platform FleetIntel’s frontend application runs on, including access controls, incident management, and operational security.
Automated code scanning
Via Lovable
Lovable automatically scans generated code, dependency trees, and database configurations for known vulnerabilities and unsafe settings. Findings are categorised by severity and surfaced before deployment.
No training on your code or prompts
Via Lovable
Lovable does not use customer prompts, code, or workspace data to train models. Contractual agreements with their AI sub-processors restrict both training and retention of customer data.
EU data residency
Via Lovable
Lovable Cloud supports regional data hosting including the EU. Customer data remains in the selected region by default and does not move across regions without explicit configuration.
Workspace isolation
Via Lovable
Each Lovable workspace and project is logically separated at both application and infrastructure layers. Customer data is not accessible across accounts. Environment boundaries are explicitly enforced before changes are published.
Full details available at lovable.dev/security
Access control
Who can see what is enforced at every layer — from the database up to the interface.
Account isolation
Live
Each fleet account is fully isolated. No user can access another organisation’s data. Enforced at the database level through Row Level Security policies — not application logic alone.
Authenticated API access
Live
All API requests require a valid authenticated session token. Unauthenticated requests are rejected before reaching any data layer. Tokens expire and rotate automatically.
Multi-factor authentication
Coming soon
MFA enforcement for all user accounts is on the roadmap. When available, it will be configurable at the account level with support for authenticator apps.
SSO / SAML
Coming soon
Single sign-on via SAML will be available for operators who need to authenticate through an existing identity provider — Okta, Azure AD, and others.
Audit logs
Coming soon
Full workspace event logs — who accessed what, when, from where — will be available for compliance-conscious fleet operators and enterprise accounts.
AI & data governance
FleetIntel uses AI to power its compliance agents. Here is exactly how your data is handled during AI processing.
Never trained on your data
Live
We maintain a strict policy against using customer data to train or improve any AI model — ours or our providers’. Your operational data is used to answer your query and nothing else.
Zero retention by our AI provider
Live
FleetIntel uses the Anthropic Claude API with zero data retention. Inputs and outputs are not stored by Anthropic beyond the immediate request. Nothing is logged, retained, or used for model training.
Isolated processing
Live
All AI requests are transmitted individually through SSL-encrypted channels. Your data is never batched with other customers’ queries or shared across accounts.
Your data serves only you
Live
All AI responses are strictly scoped to your account. No cross-customer data mixing occurs at any point in the processing pipeline.
Sub-processor compliance
Live
Our AI sub-processor (Anthropic) maintains SOC 2 Type II compliance. Their security controls meet the same rigorous standards we hold for our own infrastructure.
Safety review before deployment
Live
Every AI capability undergoes internal security and legal review before it is made available in the product. No experimental features reach production without that review.
Compliance
FleetIntel is built on EU infrastructure and operated under GDPR obligations. Additional certifications are in progress.
GDPR
FleetIntel is operated from the EU and stores all data in EU-region infrastructure. We process personal data only as necessary to provide the service, and data subjects have the right to access, correct, and delete their records.
Live
Supabase SOC 2 Type II
Our database infrastructure provider holds SOC 2 Type II certification, independently verifying their security controls, availability commitments, and data handling practices.
Via Supabase
SOC 2 Type II (FleetIntel)
An independent SOC 2 Type II audit of FleetIntel’s own systems and practices is planned as the product scales.
In progress
ISO 27001
Information security management system certification is on the roadmap for enterprise readiness.
Planned
Questions about security or data handling?
We’re happy to share further documentation or walk through our setup with your compliance team.