Security policy

Hosting

Driver Challenge runs on Google Cloud in the Montréal region (northamerica-northeast1): application servers on Compute Engine and a managed MySQL database on Cloud SQL. Nothing is hosted in the United States.
Google Cloud data centres hold industry certifications such as ISO/IEC 27001 and SOC 2, and encrypt data at rest by default.
Traffic to our services passes through Cloudflare's web application firewall, and every connection uses TLS 1.2 or later, including between MyGeotab, Geotab Drive and our servers, and between our servers and Geotab.

Least-privilege access to your Geotab data

Driver Challenge reads your database with a dedicated, view-only service account that it creates during setup, with a long random password. Nobody types or shares a personal password.
View-only means it cannot create, change or delete vehicles, users, rules, trips or anything else in your database.
You stay in control: deactivate or delete the service account in MyGeotab at any time to stop all access. Reconnect in Driver Challenge creates a new password whenever you want to rotate it.
Driver Challenge reads only users, groups, rules, trips, rule events and, where available, fuel used. It never reads GPS positions.

Access to Driver Challenge

Managers and drivers reach Driver Challenge only through MyGeotab and Geotab Drive, signed in with their own Geotab accounts and subject to the security clearances and groups your administrators set.
Settings can only be changed by users with access to System settings in MyGeotab.
Requests from the add-ins to our servers carry the user's MyGeotab session, which our servers verify with Geotab before answering.

Our team

Production access is limited to the D2GO staff who operate the service, on a need-to-know basis, and multi-factor authentication is enforced for all staff.
Staff access to customer data is limited to operating, supporting and securing the service.

Availability and recovery

We target 99.5% monthly availability, as set out in our service level policy.
Services are monitored 24 hours a day, 7 days a week.
The database is backed up nightly with point-in-time recovery, and backups are verified and tested regularly. Most data can also be rebuilt from your Geotab database. Our disaster recovery plan has the details.

Software and changes

Every change to the add-ins goes through automated tests, linting and static security analysis (SAST) before it is deployed.
Updates are deployed to a staging environment first, and to production outside business hours when they could cause downtime.

Incidents

Report an emergency or a suspected incident at any time to oncall@d2go.io.
If an incident affects your organization's information, we will tell you without undue delay, with what happened, what was affected and what we are doing about it, so you can meet your own obligations. Where the law requires, such as under Québec's Law 25 when there is a risk of serious injury, we will also notify the authorities.

Reporting a vulnerability

If you believe you have found a security issue in Driver Challenge or d2go.io, please write to our security officer at security@d2go.io with enough detail for us to reproduce it. Please give us a reasonable time to fix it before disclosing it publicly.