Security & Compliance

1) Security Overview

• Cloud Infrastructure: Google Cloud (Cloud Run, Firestore, Cloud Storage) with Google-managed encryption at rest and TLS in transit.
• Data Region: Primary processing in us-central1 unless otherwise agreed. Some integrations may process in additional regions selected by the Operator.
• Tenant Isolation: Logical isolation by company/operator at the app and database layers; scoped queries and guards throughout.
• Backups & DR: Regular backups with restore testing; documented disaster recovery runbooks.

2) Identity & Access Management

• Auth: Firebase Authentication. MFA support where available.
• RBAC: Super Admin, Operator, and Customer roles; least-privileged internal access.
• Sessions: Short-lived tokens, secure cookies, inactivity timeouts.
• Reviews: Periodic access and key/secret reviews; immediate revocation on separation events.

3) Application Security

• Peer code review, dependency scanning, and environment-specific configuration.
• OWASP-aligned input validation, CSRF protections, and output encoding.
• Secrets in managed stores (e.g., Secret Manager); least-privileged service accounts.
• Audit trails for key actions where available.

4) Platform & Network Security

• Isolated GCP projects and IAM policies; firewall rules restrict access paths.
• Centralized logs/metrics/alerts; anomaly detection on critical flows.
• Autoscaling/health checks; blue/green or rolling deploys for safer changes.

5) Data Lifecycle & Privacy

• Minimization: Collect only what’s needed; Operator-enabled integrations are explicit.
• Retention: Configurable retention aligned to contractual/legal needs; export/delete tooling.
• Encryption: TLS 1.2+ in transit; encryption at rest via cloud provider (e.g., AES-256).
• Transfers: International transfers governed by DPA with SCCs/UK Addendum where applicable.
• Standards: Program aligned to PIPEDA/PIPA (Canada), GDPR (EU/UK), CCPA/CPRA (US) as applicable.

6) Incident Response

• 24×7 monitoring of critical paths; severity-based classification and triage.
• Containment/eradication playbooks (credential rotation, access revocation, isolation).
• Customer notifications without undue delay where required, including remediation summaries.
• Post-incident reviews with action tracking.

7) Vendors & Sub-processors

Material vendors undergo security/privacy review; DPAs and confidentiality apply. Core sub-processors (feature-dependent):

• Google Cloud Platform (incl. Firebase/Firestore/Cloud Run/Storage) — hosting & data processing.
• Stripe — payments/billing.
• Telephony/SMS (e.g., Twilio/WhatsApp) — messaging if enabled.
• Telematics (e.g., Geotab, Navixy) — device/vehicle data when enabled.
• Analytics/Error monitoring — product analytics/crash reporting (if enabled).

Subscribe to changes: privacy@novatelematics.com

8) Vulnerability Management & Testing

• Regular scans and dependency updates; severity-based SLAs for remediation.
• Periodic independent penetration testing; executive summaries available under NDA.

9) Compliance & Governance

• Documented privacy program and training; change management and privileged audit logging.
• Support for data subject requests via Operator workflows.
• DPA with TOMs, sub-processors, and SCCs/UK Addendum: see /dpa.

10) Report a Security Issue

Email security@novatelematics.com with details and steps to reproduce. Please avoid public disclosure until remediation. For privacy questions: privacy@novatelematics.com.

11) Quick FAQ