Security-sensitive deployments
Custom clients can discuss separated environments, dedicated infrastructure, access controls, audit expectations, and SC-cleared engineer involvement where required and appropriate.
Data Processing
Data protection terms for Fleet and Custom tracking.
Business deployments can involve vehicle, asset, staff, contractor, or operational location data. Before onboarding, OneTrax confirms the customer role, processing terms, retention, subprocessors, security measures, and any separation requirements.
DPA and schedule available
Fleet and Custom customers can request a Data Processing Agreement and customer-specific data-processing schedule before devices are deployed.
Roles
You decide the tracking purpose. OneTrax runs the platform.
For Fleet and Custom deployments, the customer will often act as the controller for their organisation's tracking use. OneTrax normally acts as processor for platform hosting, support, alerts, maintenance, and service delivery.
Customer responsibilities
- Tell drivers, staff, contractors, or users that tracking is in place.
- Set the tracking purpose, lawful basis, access rules, and private-use rules.
- Decide retention, internal permissions, and who receives alerts or reports.
- Make sure the deployment is lawful, necessary, proportionate, and documented.
Subprocessors
Service providers used to run OneTrax.
OneTrax uses the providers below for the public website, app, platform, connectivity, monitoring, and alerts. The customer schedule confirms which providers apply to a specific Fleet or Custom deployment.
ProviderPurposeLocation or region
Amazon Web Services (AWS)Platform hosting, databases, backups, secrets management, and email delivery where AWS SES is used.Hosting region confirmed in the customer schedule. UK-region hosting can be scoped for UK deployments.
CloudflareDNS, TLS, website delivery, web security controls, and access protection where enabled.Global edge network.
Google servicesGoogle Maps display, assisted location services, and hosted fonts on the public website.Google infrastructure.
FirebaseMobile push notification delivery and notification tokens where app alerts are enabled.Google Firebase infrastructure.
1NCESIM connectivity, mobile data, SMS fallback, connectivity management, and related network events.1NCE and mobile network partner infrastructure.
UptimeRobotService uptime monitoring and availability checks.External monitoring provider.
SlackInternal operational alerts for service monitoring and incident response.External collaboration provider.
What gets agreed
Clear terms before the system goes live.
A Fleet or Custom setup can document the practical points that matter for tracking data, from who can see locations to how long data is kept and which suppliers support the service.
Typical DPA points
- Processing only for the agreed tracking and support purposes.
- Security, confidentiality, account access, and audit expectations.
- Subprocessors, hosting region needs, retention, deletion, and return of data.
Security measures
OneTrax uses TLS for web and API traffic, controlled account access, role-based permissions where supported, monitoring, backups, and limited operational access for service delivery and support.
Deletion and retention
The default service retention is up to 90 days for location positions and events, and up to 30 days for operational backups. Custom retention can be agreed in the customer schedule.
Breach notification
If OneTrax becomes aware of a personal data breach affecting a customer environment, affected business customers will be notified without undue delay, with details confirmed through the DPA or customer schedule.
Subprocessor changes
Subprocessor changes for a signed customer environment are handled through the agreed DPA or customer schedule so the customer can review changes that affect their deployment.
Need data-processing terms?
Tell us the customer type, device count, tracking purpose, and any separation or hosting-region requirements so OneTrax can prepare the right documents.