Fleet dispatch app security
Fleet dispatch app security checklist
Before you launch a fleet dispatch app, check authz, pii, abuse, uploads and compliance. The rules below are the ones this category most often gets wrong; each one is concrete enough to test.
Last checked
Security: authz
- Drivers can read and write only stops on their active route; customer users only their account's shipments; tracking tokens are random, hashed at rest, expire after delivery plus a grace period and reveal nothing beyond the one shipment.
- Customer API keys are hashed at rest, scoped to one account, revocable and rate limited; webhook payloads are signed and secrets are write-only.
Security: pii
- Driver location is collected only while on shift with visible indicator, never after logout, retained for a limited window, and not shown to customers beyond the approach to their stop; recipients' addresses and contacts are encrypted and masked in logs.
Security: abuse
- Tracking links are not guessable or enumerable, rate limited, and do not disclose driver identity beyond a first name; proof uploads are rate limited and size capped.
Security: uploads
- Proof images are type- and size-validated, EXIF location stripped from customer-facing copies, scanned, and served only by signed URLs.
Security: compliance
- Stop events and proofs are insert only; edits to delivery outcomes are new events with reason and actor and are audited; time and position come from the device but the server records receipt time.
Compliance notes
- Hours of service and driver rules (applies to commercial vehicles): Driving and rest-time rules (for example EU 561/2006, FMCSA ELD) are legal obligations; phase 1 tracks working time for warnings but does not replace a certified tachograph or ELD.
- Location data and worker privacy (applies to EU and UK drivers): Employee location tracking needs a lawful basis, notice, purpose limitation and often works-council agreement; limit collection to shift hours.
- Dangerous goods and customs (applies to regulated cargo): Hazardous materials (ADR/IATA) and customs declarations have formal documents and training; the app stores references and documents and does not certify compliance.
- Proof retention and disputes: Keep POD evidence for the contractual claim period; delete or anonymise afterwards.
Limits that stop abuse and surprise bills
- routing api calls day: hard per-day call budget; at 90% ETAs use cached estimates, at 100% routing calls are refused.
- geocoding calls day: per-day geocode budget with a 30-day cache; imports pause when exhausted.
- sms per org day: daily message ceiling per organisation, fails closed.
- ping rows per org day: per-tenant ceiling on stored pings; batches over the limit are rejected with 429.
- storage gb per org: per-tenant quota for proof images.
Test it yourself before launch
Forge64 gives every app its own Postgres database and runs a quality gate that flags unauthenticated writes and secrets in client code before you see the app. It does not replace your own testing, and it holds no third-party security certification today.
This is a reference design for the category, not a promise that every item is generated today. Built-ins such as background jobs, file uploads and search are rolling out; email sent from your app is coming soon, so anything here that needs it is something you add yourself for now.
- Sign in as two different users and try to open each other's records by changing the id in the address.
- Submit each form with an empty value, a very long value and a script tag, and check the result.
- Call each write endpoint without signing in and check that it refuses.
FAQ
- What is the biggest security risk in a fleet dispatch app?
- Drivers can read and write only stops on their active route; customer users only their account's shipments; tracking tokens are random, hashed at rest, expire after delivery plus a grace period and reveal nothing beyond the one shipment.
- Does a fleet dispatch app have compliance obligations?
- Hours of service and driver rules, if you have commercial vehicles: Driving and rest-time rules (for example EU 561/2006, FMCSA ELD) are legal obligations; phase 1 tracks working time for warnings but does not replace a certified tachograph or ELD. This is a starting point, not legal advice.
- Will Forge64 certify my app as secure?
- No. Forge64 holds no third-party security certification today and does not certify apps. The checklist is a way to test your own app.
Build your app with Forge64
One prompt to a running app with auth, database, hosting and payments. Start free, no credit card required.
Start building for free