Security
How we protect what you give us · Last updated August 02, 2026
We host our own products on our own machines. That's a deliberate choice: it means there is a short, comprehensible list of things between you and your data, and we know every item on it. This page describes what we actually do, not what a certification would let us claim.
In transit
- Every connection is TLS 1.2 or better. Plain HTTP redirects to HTTPS.
- HSTS is set, so a browser that has visited once won't try HTTP again.
- Traffic between our own servers stays on a private network and never crosses the public internet unencrypted.
At rest
- Databases and backups sit on encrypted volumes.
- Particularly personal fields are encrypted a second time at the application layer, so that a stolen database file is not the same thing as a readable one.
- We don't store passwords for most products — we send a one-time six-character code to your email address instead, it expires within the quarter hour, and it is destroyed the moment it's used. A code is tied to the browser that asked for it, so one lifted from your inbox is no use anywhere else. Where a password still exists it is hashed with bcrypt and we cannot read it.
- Full card numbers never reach our servers. Stripe holds them; we see the last four digits.
Access
- We are a small team of three, and access is limited to the ones who need it for the task at hand.
- Administrative access requires multi-factor authentication and is logged.
- We do not read your content. Support staff — which is to say, us — look at an account only when you've asked us to, or when we're chasing a specific fault, and the fewest records that answers the question.
- Production credentials are held in encrypted credential stores, never in source control, and rotate when anybody's access changes.
Keeping it running
- Databases are backed up daily, encrypted, and held in a separate location.
- Restores are tested — a backup nobody has restored isn't a backup.
- Dependencies are monitored for published vulnerabilities and patched promptly; security updates jump the queue.
- Every deploy runs an automated test suite and a static security scan before it ships.
Reporting a vulnerability
If you've found a security problem in one of our products, please tell us at security@eadiefleet.com. Include enough detail to reproduce it. We'll acknowledge within two business days, keep you posted while we fix it, and credit you when it's resolved if you'd like us to.
We won't pursue legal action against anybody who reports a vulnerability in good faith, gives us reasonable time to fix it before disclosing it, and doesn't access, alter, or destroy other people's data while investigating. Please don't run automated scanners or load tests against our production systems — write to us first and we'll arrange something.
We don't currently pay a bounty. We'd rather be honest about that than imply one.
If a breach happens
We'll tell you. Specifically: what happened, what data was involved, when we found out, what we've done about it, and what you should do. We'll notify affected people and the Office of the Privacy Commissioner of Canada as the law requires, and we won't wait for a complete picture before saying something — a partial, honest account on day one beats a polished one a fortnight later.
What we don't claim
We are not SOC 2 audited and we don't hold an ISO 27001 certificate. We're a three-person company and those audits cost more than they'd tell you about us. If you need that paperwork for a procurement process, say so early and we'll tell you honestly whether we can meet it rather than waste your time.