Security

Every organization's data is scoped by organization at the application layer. Users can only query records belonging to their own organization, and role checks (admin / manager / technician) are enforced on every request. Platform administrators' cross-organization access is logged.

All traffic to fleetoms.com and the Fleet OMS API is served over HTTPS (TLS). Database connections in production use encrypted connectivity.

Production data is stored in AWS services (RDS, S3) with encryption at rest enabled.

Sign-in uses short-lived signed session tokens (60 minutes) with server-side revocation on logout. Password changes and account deletion require re-authentication.

Passwords are hashed with bcrypt — we never store or log plaintext passwords.

Access is role-based: technicians, managers, and organization admins each see and can change only what their role allows. Organization settings and billing are restricted to admins.

Subscriptions and payments are processed by Stripe. Card details are collected and stored by Stripe only — they never pass through or persist on Fleet OMS servers.

The production database runs on AWS RDS with automated backups and deletion protection. Regular on-site backups of the full application are kept for disaster recovery.

Security-relevant events (authentication, permission denials, administrative actions) are logged with timestamps and source context. Service health is monitored continuously.

You own your data. Organization admins can request an export at any time, and account deletion is self-service (with a 30-day reactivation window before permanent removal).

Where AI features are enabled, customer data is used only to serve that customer's own requests within their organization. We do not sell customer data or use it to train third-party models.

Found a security issue? Email info@fleetoms.com with details. We take reports seriously and will work with you on responsible disclosure.