ePoynt
/ security & data

What we can prove.

FleetPoynt holds a public fleet's register — the vehicles, the money spent on them, and the paper trail behind every disposal. Everything on this page is shipped and verifiable in the product today, not a roadmap written in the present tense.

/ controls

Eight things we can show you.

Not a policy document. Each of these is a behaviour of the running system that you can test on your own pilot data.

Who can get in
  • Multi-factor sign-in with any authenticator app, plus ten single-use backup codes shown once at enrolment
  • Passwords hashed with bcrypt; sessions ride httpOnly cookies that page scripts cannot read
  • Rate limiting on every endpoint — 100 requests a minute, tightened to 5 a minute on sign-in
  • Unlimited free viewer seats, so nobody has a reason to share a login to see the register
Who can see what
  • Every read is scoped to your organisation — one register, one fleet, no cross-tenant surface
  • A custodian — the office-holder who physically holds a vehicle — sees only that vehicle: its identity, service due, tyre size, maintenance history and movements
  • A custodian never sees money, compliance data, another vehicle, or any fleet-wide count
  • That boundary is enforced by a test that enumerates every organisation-wide endpoint and fails the build if a new one is added without the guard
The register cannot be quietly rewritten
  • Every change to a vehicle is appended to an audit trail with the actor, the timestamp, and the old and new value
  • Those audit rows are never updated and never deleted
  • Nothing else is deleted either — a mistaken policy, paper, job card, trip or fuel entry is cancelled and stays in history
  • A vehicle is never hard-deleted; disposal is a recorded status change carrying its own approval trail
Nothing is written for you
  • No uploaded list and no scanned document creates or changes a record until a person confirms it
  • AI scanning produces drafts only — it never commits a row
  • Illegible values stay blank. The scanner does not guess a plate, a date or an amount
  • Duplicate matching surfaces the conflict for a human to settle rather than merging silently
Documents
  • Vehicle documents live in a private bucket — there is no public URL to guess
  • Reads are five-minute signed links, issued one request at a time to someone who already has access
  • Uploads accept JPEG, PNG, WebP or PDF, up to 10 MB
  • Your organisation’s logo is the only object served publicly, from a separate bucket that holds nothing else
Encryption & transport
  • TLS on every public endpoint, with managed certificates and automated renewal
  • HSTS and hardened response headers on the API
  • Managed PostgreSQL with provider-level disk encryption
  • A CI security gate on every change — static analysis, dependency audit and migration smoke tests before anything merges
Where your data lives
  • Your register and your documents are held in EU data centres on managed cloud infrastructure, under a jurisdiction restriction that keeps them there
  • Encrypted in transit, and at rest by the storage provider
  • Cross-border processing is governed by our data-processing terms, in line with NDPR
  • Exact regions, our subprocessor list and a signed DPA are available for your due-diligence file — just ask
If something breaks
  • The register runs on managed PostgreSQL with automated platform backups, encrypted at rest
  • Recovery follows a written procedure with verification steps — restoring beside the live database, never over it, so a bad restore cannot compound the incident
  • Your documents sit in separate object storage with its own redundancy; a database incident does not touch them
  • Nothing in the product overwrites or deletes a stored document, so there is no version of a file to lose
  • And you are never dependent on our recovery: every register exports to CSV on demand, on every plan, so an organisation that exports monthly holds a complete copy of its own record

What FleetPoynt holds about drivers, custodians and vehicle movements — who can see it, where it is held and how long it is kept — is set out in full in the FleetPoynt privacy notice.

/ leaving is not a punishment

The register is yours.

A fleet register is an institutional record that has to outlive whichever software is holding it — including ours. So getting the whole thing out is a normal feature with a button on it, not a support ticket and not a negotiation.

Every register exports to CSV
Vehicles, maintenance, insurance, statutory papers, drivers, the movements log, fuel and disposals — each one a file you can open in Excel and total.
On every plan, not gated by tier
Export is not a paid add-on and not a Scale-tier feature. Nothing in FleetPoynt is feature-gated by plan, and this least of all.
The exported file says what the screen says
Verdicts in the export — service overdue, cover expired, a fuel anomaly — are computed by the same rules the register uses, so the file cannot quietly disagree with the product.
Log books and the monthly report print
The maintenance, insurance, disposal and movement log books print audit-ready, and the monthly management report is one click — on paper, on your letterhead.
What FleetPoynt is not

The honest column.

Plenty of fleet products promise more than they ship. Knowing the edges before you buy is worth more than a longer feature list.

✕
FleetPoynt is not a replacement for official government vehicle registration, insurance, or regulatory systems. It is your own record of them.
✕
No live GPS or tracker integration, no NAICOM / NIID insurance verification, and no government registration sync. FleetPoynt is your register, not a lookup into someone else's.
✕
Not parts inventory, workshop management, or driver payroll — the register and its log books, done properly.
✓
Verification integrations — insurance and registration lookups, GPS trackers — can be added where official or partner access is available.
✓
Certifications, audit reports and security questionnaires: send yours and we will answer it in writing, in full, before you commit to anything.
/ ask us anything harder

Bring your security questionnaire.

Send your due-diligence questionnaire and we will answer it in writing, in full — including our subprocessors, hosting regions, backup schedule and retention, and a signed DPA for your file. Found something that looks wrong? Tell us and we will acknowledge it within one business day.

Send us your questionnaire Or start a 30-day pilot