How access is controlled
- Every operator user and driver has their own sign-in. Access codes are 10 digits and stored only as a salted hash.
- Roles: administrators, users and drivers. Drivers can only reach the driver screen. Each operator can only see its own data.
- Every request checks the session is still allowed, so removing a person, changing their role or resetting their code takes effect within 20 seconds.
- An audit trail records sign-ins, failed sign-ins, changes, control-room actions, driver checks and bus count steps. Operator administrators can view and export it.
Protecting data
- All connections use HTTPS.
- The database is in Sydney and encrypted at rest by our database provider.
- Defect photos can only be opened by signed-in staff of the operator they belong to.
- No voice recordings are received or stored.
Service providers
| Provider | Used for | Location |
|---|---|---|
| Neon (on Amazon Web Services) | Database | Sydney, Australia |
| Vercel | Website hosting and server code | United States |
| Resend | Sending email (once switched on) | United States |
| CARTO | Map tiles | Global network |
| Google Fonts | Fonts | Global network |
| jsDelivr | Demonstration videos on the website | Global network |
| Google or Apple (via the phone's browser) | Speech recognition when a driver turns the microphone on | Set by the phone's provider |
How long data is kept
| Data | Kept |
|---|---|
| Vehicle positions from TransLink's feed | 90 days |
| Road speed averages | About 13 months |
| Prediction accuracy checks | 60 days |
| Driver's live location | Overwritten every few seconds while connected to a trip |
| Sign-on checks, defects, messages, late reasons, help requests, passenger counts, end-of-shift records, audit trail and operator settings | While the operator uses Transit Ops; deleted within 90 days after the subscription ends, unless the operator asks for a copy first or the law requires longer |
| Trip performance results | Kept for network performance reporting (they contain no personal information) |
If something goes wrong
We investigate any suspected breach straight away, contain it, and tell affected operators without undue delay and within 72 hours of becoming aware. Where a breach is likely to cause serious harm, we notify affected people and the Office of the Australian Information Commissioner. To report a security concern, email dunncr@me.com.
Questions about this security: dunncr@me.com