Security & Data Handling

Road audit work means handling video of a client’s network, the GPS trace that goes with it, and sometimes footage of public roads that incidentally captures people and vehicles. This page sets out how that material is treated. It is written for the IT and procurement reviewers who need specifics rather than reassurance.

Who owns the data

The client does. Footage, telemetry, detections and the derived reports belong to the contracting authority. We process them to deliver the audit and for nothing else. We do not sell survey data, do not share it with third parties, and do not use client footage to train models without a separate written agreement that says so explicitly.

In transit

• The whole website is served over HTTPS with TLS 1.2 and 1.3, and plain HTTP is redirected rather than served. HSTS is set so a browser will not attempt an unencrypted connection after its first visit.
• Contact form submissions travel over HTTPS to the form relay and reach us by email; the form endpoint is the only external origin the site is permitted to contact, enforced by a Content-Security-Policy.
• Audit footage is exchanged over an encrypted channel agreed with the client — typically SFTP or a client-controlled cloud bucket, never consumer file-sharing links or email attachments.

At rest

• Footage and derived data are held on encrypted volumes, with access limited to the engineers working the specific engagement.
• Access is by named account. Credentials are not shared between people, and access is removed when someone leaves the engagement.
• Backups are encrypted and are restore-tested, so a backup that would not actually restore does not sit unnoticed.

Retention and deletion

Raw footage is kept only as long as the engagement needs it and is then deleted on the schedule set in the service agreement. Where a client requires deletion sooner, or requires that raw video never leaves their infrastructure, the pipeline can run against a client-hosted store instead. Ask before signing rather than after — it is much easier to configure at the start.

Road imagery and bystanders

Dashcam footage of a public road inevitably captures other vehicles and sometimes pedestrians. That material is incidental to the purpose: the models look at the road surface, roadside assets and signage, and the outputs record defects rather than people. We do not perform face recognition, do not perform number-plate recognition, and do not build any profile of individuals from survey footage.

Regulatory position

• India — DPDP Act 2023. For contracted audits we act as a Data Processor on the client’s instructions; the commissioning authority is the Data Fiduciary. Website enquiries are handled on the basis of your own submission, and you can ask us to delete them.
• Outside India. Where an engagement involves personal data of people in a region with its own regime, the applicable terms are agreed in the service agreement before any data moves.

Website security posture

• The public site is a static export. There is no application server, no database and no login behind it, which removes most of the attack surface a marketing site usually carries.
• A Content-Security-Policy restricts scripts, styles, images, fonts and form targets to our own origin plus the single form endpoint.object-src is none and framing is restricted.
• The contact form carries a honeypot field and is rate-limited by the form relay. It collects only what is needed to reply.
• The public demo runs entirely in your browser against a sample dataset. It sends nothing anywhere and needs no account.

What we do not claim

We hold no ISO 27001 or SOC 2 certification at the time of writing, and we will not display a badge we have not earned. If your procurement process requires a specific certification, tell us early so we can be straight with you about where we are rather than discovering it at contract stage.

Reporting a vulnerability

If you find a security issue in this website or in a delivered system, please tell us through the contact form on any page, with enough detail to reproduce it. We will confirm receipt and keep you updated. Please do not test in ways that would degrade service for other users or access data that is not yours.

Related

Privacy Policy · Cookie Policy · Terms of Use