Fleet platforms hold an unusually sensitive combination: employee location history, driving behaviour, vehicle locations, customer addresses and delivery schedules. That is attractive to attackers and heavily regulated in most jurisdictions.
This is a practical checklist, not a compliance treatise.
What is actually at risk
| Data | Risk if exposed |
|---|---|
| Driver location history | Employee privacy, regulatory penalty, industrial relations |
| Vehicle real-time location | Cargo theft targeting, personal safety |
| Customer addresses and schedules | Commercial exposure, customer notification duty |
| Driver personal data | Data protection breach |
| Maintenance and defect records | Litigation exposure if altered or lost |
| Video telematics footage | Highly sensitive; often includes third parties |
Note the second row. Real-time location of high-value cargo is operationally valuable to criminals, and there have been documented cases of load theft assisted by compromised tracking access. Access control here is a physical security control, not just an IT one.
Vendor support staff who can view your data need to be behind approval workflows and logging.
Vendor due diligence: what to ask
Certifications and audits
- Do you hold ISO 27001, SOC 2 Type II, or an equivalent? May we see the report or Statement of Applicability?
- When was your last independent penetration test, and will you share the summary?
- Do you run a vulnerability disclosure programme?
Architecture and data
- Where is data stored and processed, and can the region be contractually fixed?
- Is data encrypted at rest and in transit, and with what key management?
- Is customer data logically or physically separated in your multi-tenant environment?
- Which subprocessors touch our data, and how are we notified of changes?
Access and identity
- Do you support SAML or OIDC single sign-on, and is it included or an upgrade?
- Is multi-factor authentication enforceable for all users including administrators?
- Can we enforce IP allow-listing for administrative access?
- What access do your support staff have to our data, under what controls, and is it logged?
Operations
- What are your RPO and RTO, and when were they last tested with a real restore?
- What is your incident notification commitment, in hours, and to whom?
- How long are audit logs retained, and can we export them?
Exit
- What format is our data returned in, how fast, and at what cost?
- How is data deleted after termination, and will you certify it?
What you own regardless of vendor
Shared responsibility is real. The vendor secures the platform; you secure your use of it.
- Identity. Enforce SSO and MFA. Ban shared accounts. Integrate leaver processes with your identity provider.
- Least privilege. See roles and permissions. Quarterly access reviews with a signed record.
- Export control. Bulk exports are the most common route for data to leave. Restrict who can export, and log it.
- Device security. Driver tablets and phones need screen locks, remote wipe, and a documented process for lost devices.
- Third-party access. Maintenance vendors, insurers and consultants with logins are a real exposure. Time-bound their access.
- Configuration drift. Someone will eventually enable a public sharing link or an open API token. Review settings periodically.
Telematics data and privacy law
Location and behaviour data about identifiable drivers is personal data in the EU, UK and a growing list of jurisdictions. Practical obligations:
- A lawful basis, usually legitimate interest, documented with a balancing assessment.
- Transparency — drivers must know what is collected, why, and for how long. A signed acknowledgement is good practice.
- Proportionality — continuous tracking outside working hours is difficult to justify. Privacy modes for personal use are expected in many jurisdictions.
- Retention limits — indefinite retention of granular location history is hard to defend. Set a policy and enforce it in the platform.
- Works council or union consultation where applicable, which in several European countries is a legal precondition rather than a courtesy.
Full treatment in telematics data and driver privacy.
Incident response
Agree before you need it:
- Who the vendor notifies, through which channel, within how many hours.
- Who on your side owns the response and who can authorise disabling the platform.
- Where your logs come from if the platform itself is compromised.
- What your regulatory notification clock looks like — 72 hours under GDPR, and it starts at awareness.
- How you would operate for 48 hours without the platform. Write the manual fallback down; a fleet with no paper process is a fleet that stops.
Common questions
Is a small vendor inherently less secure?
Not inherently, but smaller vendors more often lack formal certification, dedicated security staff and tested recovery procedures. Ask for evidence rather than assuming either way, and weight the answers by how much of your operation depends on the platform.
Do we need a DPA with our fleet software vendor?
If you are subject to GDPR or similar regimes and the vendor processes personal data on your behalf, yes — a data processing agreement is a legal requirement, not an option. It should name subprocessors, transfer mechanisms and deletion obligations.
How long should we keep telematics data?
Long enough for the purpose you documented, and no longer. Many fleets settle on 90 days for granular position data, 12–24 months for aggregated trip and behaviour summaries, and longer only where an incident, claim or legal hold requires it.
What is the most common real-world security failure in fleet systems?
Stale accounts. Departed employees, ex-contractors and unused administrator logins that were never revoked. It outnumbers every sophisticated attack, and it is entirely preventable with SSO and a quarterly review.
Should we allow drivers to use personal devices?
It is workable with a managed application, containerisation and a clear policy covering data, monitoring and what happens on termination. Without those controls, company data ends up on devices you cannot audit or wipe.
