How we protect Trackid accounts and data

• Row-level access control

  Every table in our database enforces row-level security, so an operator, parent, driver, or school can only ever read the rows that belong to them.

• Encrypted credentials

  Sensitive credentials, such as an operator’s own payment-collection passphrase, are stored encrypted (AES-256-GCM), never in plain text.

• Hashed tokens and codes

  One-time verification codes and legal-acceptance records are stored as hashes, never as the raw value.

• Time-limited location links

  GPS commute-map links are single-purpose, expire automatically, and can be revoked — they are never indexed or cached.

• Rate limiting

  Registration, login, and one-time-code requests are all rate-limited to reduce automated abuse.

Found a security issue? Email hello@trackid.co.za and we will respond as a priority.