Security & privacy
Sharing a vehicle is not sharing your data.
Pooling is the part of this product that makes a risk team sit up, and rightly so — the trip record is shared, and the passenger list contains where people live and what time they finish work in the dark. Here is exactly how that is separated.
One trip, several owners, no shared view.
This is the highest-severity design question in the whole product, so it is worth being concrete about it rather than saying the word encryption.
Authorization is per seat, not per trip
A pooled trip has one identifier and several owners. Every read is scoped to the seats you paid for, at the query layer rather than in the interface. Asking for a trip you partly own returns your seats and an occupancy count.
No cross-employer directory
There is no screen, export or API response in the product where one employer can enumerate another's staff. Pooled riders are counted, never named.
Drivers see one manifest at a time
A driver sees names and PINs for the run they are currently driving, and loses access when the run closes. Historic manifests are not browsable from the driver app.
Home addresses are the sensitive field
Pickup points are stored separately from the rest of the employee record, are never exposed to another employer, and are only resolved to a street location inside the routing engine.
The controls that hold up on a Tuesday night.
Driver vetting
License, police clearance, vehicle inspection and passenger insurance, re-verified every six months. An expiring document pulls the driver off published runs automatically rather than raising a task somebody has to action.
Trip integrity
A credit only moves when a boarding PIN is presented. That single control removes the two common fraud patterns: charging for a passenger who was never collected, and a rider claiming a seat they were not entitled to.
Data retention
Trip records are kept for the period your finance team needs for audit, then reduced to aggregate. Rider location history is not retained beyond the settlement window.
Data protection
Processing is registered under the applicable data protection legislation, with a named controller relationship for employer-funded trips and a separate basis for personal trips.
Not everyone who needs a report needs the directory.
Transport tends to be owned by three teams at once, which is how staff lists end up in email attachments. The portal separates them so nobody has to be over-privileged in order to do their part.