Security

1. Infrastructure security

Traxx systems are hosted on enterprise-grade cloud infrastructure. Our infrastructure protections include:

• All servers operate within isolated, private network environments.
• Access to production infrastructure is restricted to authorised personnel only.
• Regular vulnerability assessments are conducted on our systems.
• Automated system health monitoring runs 24/7 with alerting for anomalies.

2. Availability and uptime

We target 99.9% uptime for all core Traxx services. Our infrastructure is designed with redundancy to prevent single points of failure. In the event of a service disruption, our incident response team is activated immediately to investigate and restore service.

3. Data encryption

All data processed and stored by Traxx is protected with industry-standard encryption:

• Data in transit: Encrypted using TLS 1.2 or higher across all endpoints; web dashboard, mobile apps, and APIs.
• Data at rest: Encrypted using AES-256 on all storage systems.
• GPS telemetry, rider activity logs, and audit records are encrypted end-to-end.

4. Data isolation

Each business account operates within its own isolated data environment. Your fleet data is never commingled with that of another organisation. Access controls are enforced at every layer of the stack, ensuring that only authorised users within your account can view your riders, assignments, and reports.

5. User authentication

All Traxx accounts are protected by the following controls:

• Multi-factor authentication (MFA) is available for all user accounts and strongly recommended.
• Passwords are hashed using bcrypt and are never stored in plain text under any circumstances.
• Session tokens expire automatically after periods of inactivity.
• Failed login attempts trigger lockout mechanisms to prevent brute-force attacks.

6. Role-based access control

Traxx supports granular, role-based access control (RBAC). Administrators can define who within their organisation can view, manage, or export fleet data. Access is granted on a least-privilege basis, meaning team members only see what they need to do their job, and nothing more.

7. Internal access controls

Traxx employees undergo background checks before being granted access to any system. Internal access to customer data is restricted, logged, and reviewed. No Traxx employee may access production data without documented authorisation, and all such access leaves an audit trail.

8. GPS and audit trail integrity

The integrity of the data Traxx generates is central to the platform's value. We take deliberate steps to ensure this data cannot be tampered with:

• GPS telemetry data is timestamped and signed at the point of capture.
• Audit logs are immutable; once written, records cannot be altered or deleted by any user.
• Flag detection events are recorded with cryptographic integrity checks.
• All audit exports are watermarked and traceable to the requesting account.

9. Incident response

In the event of a security incident, Traxx will:

• Investigate and contain the incident within 24 hours of detection.
• Notify affected clients within 72 hours where their data may have been compromised.
• Provide a written incident report upon request following resolution.
• Take corrective measures to prevent recurrence.

We maintain a dedicated incident response team and a documented response playbook, reviewed quarterly.

10. Third-party and vendor security

We vet all third-party vendors and service providers against our security standards before onboarding. Vendors with access to Traxx infrastructure or customer data are required to maintain equivalent or higher security controls. We conduct periodic reviews of all third-party access rights.

11. Compliance

Traxx is committed to meeting the requirements of applicable data protection laws, including the Nigeria Data Protection Regulation (NDPR). Our security practices are aligned with internationally recognised standards. We conduct internal security audits at least annually and address identified gaps on a documented remediation schedule.

12. Data retention

We retain your data for as long as your account is active or as required by applicable law. You may request deletion of your data at any time by contacting our support team. Upon a verified request, data will be permanently removed within 30 days.

13. Contact us

If you have questions about our security practices or need to report a concern, please reach out directly:

• Email: contact@traxx.ng
• Phone: +234 815 422 5462
• Location: Lagos, Nigeria