Security
What Fleetiqo can see, and what it cannot
Fleetiqo asks to read an inbox. That is a serious thing to ask for, and “bank-level encryption” is not an answer. This page sets out the actual scopes requested, what happens to the data, and where the limits are.
Email access
The Turo sync works by reading the confirmation emails Turo sends you. There is no Turo API involved, no scraping, and no Turo password — Fleetiqo could not log into your Turo account if it wanted to.
Connecting a mailbox uses the provider’s own OAuth flow, with these scopes:
| Provider | Scopes requested | What that allows |
|---|---|---|
| Google / Gmail | gmail.readonly, userinfo.email | Read messages. Cannot send, modify, label or delete anything. |
| Microsoft / Outlook | Mail.Read, User.Read, offline_access | Read messages, read your basic profile, refresh the token in the background. Send and delete are not permitted. |
| iCloud and other IMAP | App-specific password, IMAP read | Read the mailbox. Use an app-specific password so it can be revoked without touching your main account password. |
Microsoft access originally requested Mail.ReadWrite. That was reduced to Mail.Read to follow least privilege, because nothing in the product needs write access to your mailbox.
You can disconnect a mailbox in Fleetiqo at any time, and independently revoke Fleetiqo from your Google or Microsoft account security settings. Revoking at the provider is immediate and does not depend on us doing anything.
What is actually stored
Fleetiqo does not archive your mailbox. It matches incoming messages against known Turo notification formats and extracts the fields that make up a booking: trip dates, vehicle, guest name, amounts and status. That extracted record is what gets stored. Messages that are not Turo notifications are ignored and not retained.
Beyond that, the data in your account is what you put there: vehicles, expenses, customers, rental agreements and any driver-licence images you upload. The full per-category breakdown, including which sub-processor sees what, is on the sub-processors page.
Encryption
Traffic is served over TLS, with HSTS enabled in production including subdomains.
Sensitive credentials — mailbox tokens, integration secrets, two-factor seeds — are encrypted before they reach the database using authenticated AES-256-GCM. Each user’s data is encrypted under a per-user key, and those keys are themselves wrapped with a master key held outside the database. A dump of the database on its own does not yield usable credentials.
Database backups are encrypted and taken nightly.
Other connections
- Tesla Fleet API — OAuth against Tesla. Fleetiqo holds a token, not your Tesla password, and you can revoke it from your Tesla account.
- Fleetiqo GPS devices — position data goes to a dedicated tracking server on its own host and its own database, separate from the main application database.
- Stripe— card details are entered on Stripe’s side and never touch Fleetiqo servers. Booking-website payments go to your own Stripe account.
- Outbound email — sent through SMTP credentials you supply, so transactional mail to your customers comes from your domain rather than ours.
Infrastructure
The application and its database run on dedicated servers in a United States data centre, with GPS tracking on separate infrastructure. File uploads such as vehicle photos and signed agreements are stored in Cloudflare R2.
Security headers are applied on every response: HSTS with preload, X-Content-Type-Options: nosniff, a restrictive permissions policy, and a per-request nonce-based Content Security Policy so injected scripts do not execute.
Account security
- Two-factor authentication using TOTP, with the seed encrypted at rest.
- Biometric unlock in the iOS app, backed by the device keychain.
- Active session listing, so you can see and end sessions you do not recognise.
- Per-vehicle team permissions — a co-host can be given a single car, in view-only mode, with financial figures withheld.
- Rate limiting on authentication and public form endpoints.
Retention and deletion
You can export your data at any time while the account is active. Deleting your account removes your records on the schedule described in the privacy policy; encrypted backups are not edited in place and instead age out on their own retention cycle.
Business customers who need Article 28 terms should use the data processing addendum, which references the sub-processor list as its annex.
Incident handling
Application errors are logged centrally and reviewed. If a breach affecting personal data occurs, affected customers are notified without undue delay and, where GDPR applies, within the 72-hour window, with what we know, what we do not yet know, and what to do about it.
Changes to the sub-processor list are published on the sub-processors page, so you can watch it rather than take our word for it.
Reporting a vulnerability
Email support@fleetiqo.com with “Security” in the subject. Tell us what you found and how to reproduce it. We will acknowledge it and keep you posted on the fix.
Please do not run automated scanning against production, access data belonging to other customers, or degrade service for anyone else while testing. We will not pursue researchers who act in good faith within those limits.
Questions
- Do you store my Turo password?
- No. Fleetiqo never asks for your Turo credentials and has no way to log into your Turo account. It reads the confirmation emails Turo already sends you, through your own email provider’s authorisation flow.
- Can Fleetiqo read the rest of my email?
- The Gmail and Microsoft connections are granted read-only scopes, so technically the connection can read mail in the mailbox it was granted on. Fleetiqo only processes messages it identifies as Turo notifications; everything else is ignored and not stored. If that is more access than you are comfortable with, use a dedicated inbox and forward Turo mail to it.
- Can Fleetiqo send email as me, or delete anything?
- No. The Microsoft integration originally requested Mail.ReadWrite and that was deliberately reduced to Mail.Read. Google is connected with gmail.readonly. Neither scope permits sending, modifying or deleting messages.
- How do I revoke access?
- Disconnect the mailbox in Fleetiqo, and additionally revoke Fleetiqo from your Google Account permissions page or your Microsoft account app permissions. Revoking at the provider takes effect immediately and independently of us.
- What happens to my data if I cancel?
- You can export your records before you go. After an account is deleted, data is removed on the schedule set out in the privacy policy; encrypted backups age out on their own retention cycle rather than being edited in place.
- Are you SOC 2 or ISO 27001 certified?
- No, and we would rather say so than imply otherwise. Fleetiqo is a small team. The controls described on this page are real and verifiable, but they have not been audited by a third party. If a formal certification is a hard requirement for your business, we are not the right vendor yet.
Something not covered here? Ask us — security questions get answered by someone who works on the system, not a templated reply.