Every connection over HTTPS (TLS)
All traffic to and from the platform's applications is encrypted with HTTPS (TLS). Our databases accept encrypted connections only.
Your operation's data, protected like our own
When you run your shuttle service on the Volt Lines platform, your passengers', drivers' and clients' data lives on our infrastructure. This page explains where it is kept, how it is encrypted and kept apart from other operators', who at Volt Lines can reach it, and how the product protects each passenger's details.
EU Your data is kept in the European Union
AES-256 Files encrypted at rest
1 per operator Separate database and file storage for each operator
1 year Every administrative action on record
Data residency
Where your data is kept
The Volt Lines platform runs on one of the world's leading cloud infrastructures. Every operator's databases and files are kept in its data centres in the European Union, so your data is stored in the EU.
What our service providers receive
Some data is shared with our service providers to perform specific functions. Only the data that function needs is sent.
- Sending email
- Maps and address lookup
- Push notifications
- Error monitoring
- SMS verification codes
We share the current list of providers, by name, on request.
Encryption
Encrypted on the move and at rest
Whether it is travelling from an app to our servers or sitting on a disk, your operation's data is kept unreadable.
Files encrypted at rest
Your files are encrypted with AES-256, in file storage of your own.
Databases and backups encrypted
Your database and its backups are encrypted with securely managed encryption keys.
Backups
One mistake never costs a day's work
Every operator's database is backed up automatically every day, and backups are kept for 7 days. Within that window we can restore your database to any point in time, to the minute. Databases are also protected against accidental deletion.
- Automatic backups every day
- Restore to any minute in the last 7 days
- Protected against accidental deletion
Access and logging
Who touched what, on record
Each operator's data is kept apart, only authorised engineers can reach the production environment, and every administrative action they take is recorded.
-
Each operator kept apart
Every operator on the platform has its own database, its own file storage and its own deployment of the applications. One operator never sees another's data.
-
Limited access
Access to the production environment is limited to authorised members of the Volt Lines engineering team.
-
Every administrative action logged
Every administrative action on our infrastructure is recorded. The logs are checked for tampering and kept for one year.
-
Continuous monitoring
Our infrastructure is continuously monitored for suspicious activity by an automated threat detection service.
-
Request logs
Logs of requests to the platform's applications are kept for 90 days.
-
One-time code sign-in
Signing in to the apps is verified with a one-time code (OTP) sent to the user's phone. Each code is short-lived and works only once, so there is no password to guess or share.
Passenger privacy
Privacy, built into the product
Your passengers' phone numbers, addresses and locations never land in front of someone who has no reason to see them. The platform makes sure of that in the apps themselves, not only in a policy.
Masked calling
Passengers and drivers call each other through the app on a masked line. Phone numbers are never shown to the other side. For everyone's safety, calls are recorded.
Personal boarding code
Every passenger boards with a code of their own. No printed lists of names and phone numbers passing through your drivers' hands.
Location sharing rules
The vehicle's location is shown to passengers only during their trip. A passenger's home address is used to plan the route; the driver sees the stop, not the address.
Guardian and student data in schools
On school routes the account belongs to the guardian, and only what the service needs is kept about the student. The guardian is told when their child boards and leaves; location and contact details are never shared with other families.
Permissions
Who sees what
Your team, your clients, your drivers and your passengers each see the data they need, and nothing more.
| Data | Operator (Control Tower) | Client HR (Kopilot) | Driver | Passenger |
|---|---|---|---|---|
| Name and phone | Everything | Everything | Limited | Their own only |
| Home address | Everything | Everything | Limited | Their own only |
| Boarding history | Everything | Everything | Limited | Their own only |
| Live vehicle location | Everything | Everything | Their own only | During their trip only |
- A client sees only its own employees and routes, never another client's.
- Drivers see a passenger's name, not their number, and the stop instead of the address.
Compliance and policies
GDPR, contracts and your role
The legal side should be as clear as the technical one. Everything you will sign is in front of you before you go live on the platform.
GDPR and UK GDPR
We process personal data in line with the EU General Data Protection Regulation (GDPR) and UK GDPR. As a company based in Türkiye, Volt Lines also follows Türkiye's data protection law (KVKK).
You stay the controller
Your passengers' and clients' data is yours. You remain the data controller, and Volt Lines processes the data on your behalf and on your instructions.
Data processing agreement
We sign a data processing agreement (DPA) with you before you go live, setting out how we process data on your behalf.
Certifications
Our information security management system is certified to ISO 27001.
Incident response and breach notification
We have a defined process for security incidents, and we notify you of a personal data breach without undue delay, so you can meet your own 72-hour duty to the regulator.
Your data when you leave
When your contract ends you can export your data, after which it is deleted from the platform within an agreed period.
Security documents
We share the documents your supplier assessment needs on request and answer your security questionnaires — and help you answer the ones your own clients send you.
To report a security issue: security@voltlines.com
- PDF Data processing agreement (DPA)
- XLSX Security questionnaire answers
- PDF Certificates
Frequently asked questions
What operators, and the clients they serve, ask us most often.
Let's answer your security questions together
In the demo we walk your team through the platform and how your data is protected on it, and answer your IT and legal teams' questions in the same call.