Draft for review. This page describes how the service is designed. It will be updated as controls are verified.
Access
- Role-based access. Every user has a role: organisation admin, manager, driver, member or read-only auditor. Each role sees only what it needs.
- Least data by default. A parent sees one child’s bus. An employee sees one cab. Nobody browses other people’s locations.
- Audit logs. Admin actions such as adding users, changing routes and viewing history are logged.
Data
- Encryption in transit. Traffic between devices, apps, the dashboard and our servers is designed to use TLS. [To be confirmed before launch.]
- Encryption at rest for location history and video is part of the design [to be confirmed before launch].
- Hosting region: India [to be confirmed].
What we do not claim
CatchIt does not currently hold ISO 27001, SOC 2 or similar certifications. We will list a certification here only once it has been awarded.
Report a vulnerability
If you find a security issue, please tell us privately at [to be confirmed]. Give us reasonable time to fix it before sharing it publicly. We will not take action against good-faith research that avoids harm to users and their data.