Last updated Milebit, Inc.
This page describes how Milebit, Inc. protects the data of drivers and carriers. It is a plain account of what we do today, and we update it when our practices change.
Application servers and databases run on Railway, and uploaded files are stored with Tigris. Both are located in the United States.
Encrypted backups are kept with a second provider, Google Cloud Storage, also in the United States.
The full list of providers that receive data, and what each one receives, is in the Third-Party Services section of our Privacy Policy.
All connections to our website, apps and API are encrypted in transit with TLS.
Credentials that belong to you or to other systems are encrypted by the application before they are stored: telematics tokens (Samsara, Motive), webhook signing secrets, bot tokens and the secrets used for two-factor authentication. They are never shown again in full after you save them.
Passwords are stored only as salted one-way hashes. API keys are stored only as hashes and are shown once, when they are created.
Database backups are encrypted before they leave our infrastructure.
Roles. A fleet workspace has roles with a permission matrix, and every protected action is checked against it on the server.
Two-factor authentication. Fleet users can protect their account with an authenticator app and single-use recovery codes.
Sign-in protection. Repeated failed sign-ins lock the account temporarily. Changing a password ends that user's other sessions.
Action log. Changes made in a workspace are recorded in an action log that the workspace owner can read.
API keys and webhooks. An API key acts with the role it was given, cannot change billing and cannot create other keys. Webhook deliveries are signed, and the signature includes a timestamp so a captured request cannot be replayed later.
Two-factor authentication is mandatory for every Milebit, Inc. employee who can open customer accounts.
Support staff have read-only access. Our support tools do not let any employee change a customer's payment settings, replace or disconnect a customer's integration keys, or make themselves an owner of a workspace.
Every time a Milebit, Inc. employee opens a customer workspace, it is written to that customer's own action log. These entries are not removed by log retention limits and cannot be deleted from our support tools.
Our personnel may work from outside the United States. The data itself stays in the United States.
Scans of driver, vehicle and company documents are kept in private storage. They are opened through links that expire within minutes, and opening a driver or company document is recorded in the action log.
Uploaded files are checked by their content, not by the name or type the sender claims.
Photos attached to public road reports are processed to blur faces and license plates before anyone else can see them.
Carrier data and private conversations are not sent to DeepSeek. Text of that kind is processed by Anthropic or Google Gemini, under paid commercial API terms that do not allow training on it. Photos, videos and voice messages are processed by Anthropic or Google Gemini.
Only the content a feature needs is sent to an AI provider. We do not send location history to AI providers.
The fleet assistant can use only the data the person asking is allowed to see. The check is made by our server, not by the AI model.
Which provider handles which feature is listed in the Artificial Intelligence section of our Privacy Policy.
The database, the service configuration and uploaded files are backed up every day. Backups are kept for up to 90 days.
Services are monitored automatically, and a service that stops responding or a scheduled job that fails or does not start raises an alert to our team.
Automated tests run on our code, and dependencies are checked for known vulnerabilities.
Secrets are kept in the hosting provider's configuration, not in source code.
How long each kind of data is kept is listed in the Data Retention section of our Privacy Policy.
A driver can delete their account in the app; the steps are on our Data Deletion page. A workspace owner can ask us to delete the workspace data, or to provide a copy of it, by writing to legal@milebit.io.
If we learn of a security incident that affects customer data, we investigate it, contain it, and notify affected customers and regulators without undue delay and as the law requires.
If you believe you have found a security problem in Milebit, write to legal@milebit.io with the steps to reproduce it. Please give us reasonable time to fix it before sharing it publicly, and do not access data that is not yours.
A data processing agreement is available to Fleet Customers on request at legal@milebit.io.
Questions about this document?
Write to us — we answer within a few business days.