Trust & security
The evidence, not the adjectives.
This page is written for the person who has to fill in a form about us. Everything below is a concrete control, not a marketing word — and where a certification is still ahead of us, it says so. If you need a security questionnaire completed or a VPAT, we’ll do it.
Tenancy & data
- Data residency
- Hosted in Australia. Data sovereignty is a first-class requirement for our government segment, not a deployment afterthought.
- Tenant isolation
- Enforced at the database layer with row-level security — not just in application code. Cross-tenant reads are structurally prevented.
- Portability
- Export everything, any time, in open formats. Exit is a contractual feature, never fine print. We refuse the “data hostage” pattern.
Access & accountability
- Role-based access
- 17 roles across four portals, scoped to org — and narrowed to client or driver where the role demands it.
- Privileged access (PAM)
- Elevated actions require a grant with a two-person rule and time limits. Break-glass is capped and fully audited.
- Immutable audit trail
- Every action of consequence is recorded to an append-only trail — the record an ATO audit or FOI release actually needs.
Identity & standards
- Single sign-on
- SAML/OIDC via a pluggable identity layer — the same button your team uses for everything else at work.
- Accessibility
- WCAG 2.2 AA is a hard floor, aligned to the Australian Digital Service Standard — the exact bar the government buyer is audited against. VPAT/ACR on request.
- Certification roadmap
- ISO 27001 and Essential Eight ML2 are on the roadmap; we state where we are honestly rather than implying more.
Need our security summary as a leave-behind for procurement? We’ll send the pack — controls, residency, accessibility statement and roadmap in one document.
The parallel run
See everything. Change nothing.
Bring your real fleet in and run Fleeter alongside your current system. It touches nothing live. In week one you’ll see the idle vehicles and lapsed regos your system never showed — on your own data. Going live is a deliberate, recorded act, if you ever choose it.