Security
Your fleet data, under lock and key.
Location history says a lot about a business. ZonePin guards it with two-factor sign-in, scoped roles, encryption and a full audit trail — and walls every customer’s data off from the rest.
- TLS everywhere, encrypted at rest
- Two-factor for every admin
- Fleets hosted in Mumbai, India
Audit log
Append-onlyEvery change, on the record
- 09:41:07Role changed → Dispatcher, Southpriya@ · Admin49.36.•.•
- 09:38:52Two-factor required for everyoneops@ · Owner103.21.•.•
- 09:12:30Read vehicles · 42 recordsAPI key · erp-sync13.232.•.•
- 08:55:14Workspace viewed · session recordedZonePin support—
- 08:31:40Signed in · new devicearjun@ · Fleet manager157.48.•.•
Two-factor code
Verified
Dispatcher · South
42 vehicles in scope
Access & governance · ZonePin Fleets
Access that follows your org chart.
Two-factor sign-in
Codes from any authenticator app, plus one-time recovery codes. Always on for admins, and you can require it for everyone.
Roles & scoped access
Build roles from named permissions and limit each person to the vehicle groups and regions they manage.
Append-only audit log
Every sign-in, permission change and data edit goes into a log nobody can rewrite — who, what, when and from which IP.
Safeguards · ZonePin Fleets
How your data is protected.
The technical and organisational measures we rely on. No system is ever perfectly secure, so we layer them.
Encrypted in transit
The site, the apps and the APIs only ever talk over TLS (HTTPS).
Encrypted at rest
Documents and backups sit encrypted under managed keys, and two-factor secrets are encrypted in the database too.
Passwords never stored
We keep only an Argon2id hash, and old passwords can’t be recycled.
Sessions that expire
Access tokens last 60 minutes, and no session outlives 90 days.
Walled-off workspaces
The database itself enforces the line between one customer’s data and the next.
Support access, on the record
If our team needs to look inside your workspace, it goes through a dedicated tool that records every session.
Organisational measures
Least-privilege staff access
Our people see personal data only when their job calls for it.
Vetted providers
Anyone who processes data for us is contractually bound to protect it.
A plan for incidents
Anything suspicious is investigated fast, and we tell affected people and regulators wherever the law requires it.
Where your data lives
ZonePin Fleets data — database, files and backups — stays in India, on Amazon Web Services in Mumbai.
Controls designed with GDPR, SOC 2 and ISO 27001 in mind.
ZonePin GPS
Your own car or bike, kept private.
ZonePin GPS works differently from ZonePin Fleets: no passwords and no workspaces. This is how it protects your account.
No passwords
You sign in with your phone number and a one-time code, sent by SMS or WhatsApp. There is no password to leak or reuse.
Sessions you control
A phone stays signed in until you sign out, remove it under Logged-in devices or delete your account, or we revoke it. A revoked session stops working at once. Up to 5 phones per number; signing in on a sixth signs out the oldest.
A code for the big actions
Cutting off the engine, deleting a vehicle, replacing a tracker and deleting your account each ask for a fresh one-time code.
Only the people you invite
You see only the vehicles you own or were invited to. The service checks it, and the database enforces it again. A new owner of your tracker never sees your data.
Encrypted in transit
The app and the live share links talk to our servers only over HTTPS.
Stored in India
ZonePin GPS data is stored in India, on servers ZonePin controls, and addresses are looked up by our own service, not an outside map company. The privacy policy lists the few things that leave them, such as support tickets and assistant questions; some of those providers may process them outside India, under agreements that protect them.
Security questions?
Talk to us about your requirements.
Security reviews, questionnaires and data-processing terms — we are happy to walk your team through them.