Security and privacy
Tomcabs holds the takings, papers and working days of taxi companies and their drivers. Here is how we keep them safe.
GDPR
Your rights, on request, under European law.
AES-256 at rest
Everything stored is encrypted on disk.
TLS in transit
Every connection to Tomcabs is encrypted.
Data in the EU
Your records stay in the European Union.
Compliance
Built in Europe, under European rules. Tomcabs is operated by Desert Odes Ltd. in Dublin. GDPR applies to everything we do, and the Irish Data Protection Commission is our lead supervisory authority.
Read the data processing agreement- GDPR
- Access, correction, erasure, portability and objection, on request.
- Data processing agreement
- Published, and accepted by every company that runs its fleet on Tomcabs.
- Data stored in the EU
- Your company's records live in the European Union.
Data protection
Encrypted on the way, encrypted at rest. Every connection to Tomcabs uses TLS, and the database encrypts what it stores with AES-256.
- TLS in transit
- From the driver's phone and the manager's browser to our servers.
- AES-256 at rest
- Shifts, races, payments and documents are encrypted on disk.
- Short-lived document links
- A licence or a receipt opens through a private link that expires within minutes.
Access
Each company sees only its own fleet. Every company is a separate workspace, enforced by row-level security in the database, and inside it managers and drivers only see what their role allows.
- Isolated companies
- Data from one company can never appear in another's.
- Roles, checked on the server
- Hiding a button is never the only protection: every action checks who is asking.
- Drivers own their papers
- A driver shares a document with a company by permission, never by copy, and can withdraw it.
- Our own access is logged
- When our team acts on an account for support, the action is recorded.
Processors
A short list of partners, each under contract. We never sell data. The services below process it for us under data processing agreements, with Standard Contractual Clauses for any transfer outside the EEA.
Read the privacy policy- Supabase
- Database, sign-in and file storage
- Cloudflare
- Hosting and delivery
- Stripe
- Subscription payments
- Maps, and reading receipts and documents
- Sentry
- Error monitoring, without session replay
- PostHog
- Product analytics, only with your consent
- Resend
- Transactional email
Reporting a vulnerability
Found something? Tell us first. Write to support@tomcabs.com with "Security" in the subject and the steps to reproduce it. We read every report, and we will keep you posted while we fix it.
Questions about your data?
Write to support@tomcabs.com. We answer data requests within one month.