Security & reporting
Security takes more than a promise. We restrict access, check changes and explain the limits of our measures.
On this page
How access is protected
- Company workspace and role determine access. Checks take place on the server and in the database, not just in the interface.
- Encrypted connections, hashed passwords and protected sessions secure access. The native app also uses device-bound keys and an optional biometric lock.
- Important changes are recorded. Automated tests cover permissions and company separation, among other areas; they do not replace an independent audit or ongoing assessment.
- Database backups support recovery. They are not a complete copy of every server setting, an unlimited archive or a guarantee of recovery without data loss.
What you can do
Keep devices updated, use your own account and promptly report a lost device or unexpected access. Managers should remove access for departing staff and review who has administrative rights.
Report a vulnerability
Email [email protected] with the subject “Security — Drivaxo”, the affected feature, app version and brief reproduction steps. Use test data. Do not send passwords, access tokens or full customer records; we can arrange a secure channel if needed.
Stop once the issue is demonstrated. Do not read or modify other people’s data, collect datasets, disrupt service or test our suppliers’ systems. Coordinate further testing and disclosure with us.
This contact point is not general permission for penetration testing and is not a reward programme. Statutory rights and the Belgian CCB reporting procedure remain unaffected. We assess reports and keep the reporter informed where possible.
If an incident occurs
We investigate the impact, limit further harm and inform affected customers where required. Notification to authorities and individuals depends on role, risk and law. Drivaxo does not claim ISO certification, a GDPR certification mark or absolute security.