Fleetsmith security

Security is deeply considered in every aspect of our product, and in every decision we make. Stemming from our company value “Secure by Design,” we made sure that our product was secure from day one, and that our internal policies were secure from the get-go.

Our co-founder and CSO, who comes from the Dropbox Infrastructure Security Team, has built a culture that makes security top of mind for all of us.

When you use Fleetsmith, we know you’re trusting us with an incredibly important responsibility. This is our approach to security, and what we’re doing to maintain your trust in us:

Product security

We follow best practices for secure development, including security design reviews, code reviews, unit tests, and integration tests.

Infrastructure security

Corporate

• We don’t believe in the concept of a trusted corporate network. We assume all networks are untrusted, and focus instead on making sure our endpoints (e.g. laptops) are secure.

• We mandate security on-boarding training for all new hires, which includes setup and training on using a password manager.

Development & Production

• Access into both development and production environments requires both SSH keys and 2FA.

• We use Vault for secure secrets management.

Third party security

We enable mandatory 2FA for all employees on all services where it is supported. Before deciding to use another third party cloud service, we assess both the type of data that would be stored there, as well as that company’s security practices to make sure they meet our high standards.

Security audits

We believe that security researchers make computing safer and more secure for everyone, and thus we encourage security testing and research on Fleetsmith. Here are the ground rules: (a) such research must not be for the purpose of creating competitive or similar products; (b) such research must not interfere with the Services or otherwise impact the reliability, availability, or security of Fleetsmith for other users; and c) findings of said research must be disclosed to the Company and follow computer security industry best practices for responsible disclosure. Potential security vulnerabilities can be reported to us by emailing [email protected] If you'd like to encrypt sensitive information before sharing it with us, our PGP key can be found below.

-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBFgZEFoBEADwI2QvATE4KB+1dmP33UV/JpVoUbaZGhTFDDQIubInaw7lcC9a
TJkTxShcmubgQRDb3+t2wJn2+olfp4ji+Ii8dgKSq0lOTT+e/UB04S/5TvBT9oLC
uwF9j1OVTzwXWq2DvaL5M3ietua9lxBSuD4zdL4QEyuBDtZv/RgQAAncUACy1l+C
UJnW9x95fcArr7hh86bb6KQYUKf/0d2l1S52FqQ4um89WwAYqTFdEb0O6m8wdHBf
KZu6I0WOgNutTAPQBnBixVz9Zg/tKol7vsYkwiusLG7Wy/O6US94wcM/sYL3/EOU
c9ukWRoT1IjTOUnPHfOUUkx540YvISLl56fEWTW7ALXKa4e4Y4AgNHrE0tCfs6wo
NJZtc6DoYU2aDD6/sbul5fVk33Dhc9cM2rKMSgyslvm8NmnRdyBeoEhiDfBYmRp5
EvbnDQUCsCE0nim+6lP/MVRy6EDjFBXZ2i4gphra22tar56XviXXlQvoBcyZz9Rh
qxKB2YEtZRdrxZm0QD2DM9jZSrhqOMzQVDH5sda3ygwfegbU9jHX9jHSqLMjjutA
03XWzraIPRs7ly+YI2uRdvQ2KUC46h50djGQIDKdCyBKrehrITzMK7WvkaVCzmXs
ER+DppBBl+56NqIE59oHTOKeNrFeO1qFMxFb+j325EFcgCMJW+ET7f1I+wARAQAB
tC9GbGVldHNtaXRoIFNlY3VyaXR5IDxzZWN1cml0eUBmbGVldHNtaXRoaHEuY29t
PokCPwQTAQgAKQUCWBkQWgIbAwUJB4dxAAcLCQgHAwIBBhUIAgkKCwQWAgMBAh4B
AheAAAoJEEmxmzsSk7/HkVMP/jYnvwf9dhIVfWUJ11GwjQlL3/KjyhDHa/eHRrvk
7XC60fzcEbSEcayFtYLXsZfnrsd6tDtMgdMhGSkHdO3NXwel+kloMAx8UjEQKySg
V01/gBMGoHhbIx8MoDpmvT2YYZSZ5uZdQS3Rav7N/cETuVEQbYXTczq4l2yh+hk6
rTS7Lm9xA6ijJatZAQTUYQ6t6DxRpeW29nl/w3KO1KHAXRWJ7Uy1AskjxFMpJBej
aio/2dGEIBhZYXNrWJcn1ipm7KPjPKaHov4X5dOhOHJb79zXMxisfqZuXPWdBjbR
VhG2K4D7DfkOxRNySa0TiqXEcEwjI8YS0aHg6VVcz0pD0BaPcqWPP7vJEWtez1yB
CpCHl59HEeroEytOZF6o3Enllc8fUzyn4cq6RGiS/7WYD+4jFIJzec7C8t9WZfcW
DB8xSzztQ8s2saKDMaq6BL72fsG83xai3Vqy0Qw0OcOomCqJaNX+MKpnsbiCtqmi
rvX3Hjjo9KF0KejvU6E1OJny5ZbpHl8D+1M+PaUJ+itVkk2AifFBuW+mvXJ05HtF
6p/b4IpMwZ3vUaL4cav2U1WcOx8kqYz9/As66oWfn3uy7ThaUnI5E+1dK5t+uYaY
a20pmv/jzoq7FmErfFA9ZR/FtWE6NxrwyRq2xuJqt04591QfGrBIcLifAnXwV3t5
uSTzuQINBFgZEFoBEAC94Gs8dWPhJRW/0Xr+o0L8TH1boGjh8qC58yYiQ6wcp0vH
LVs8djnzauS5dyaF1wQwMJMDzpV63abGlssm5YxAEzgtJB0wm1wWddQyC0XdEviU
7Od79ncsNryVlmrOgQPXNLe//mQU5tK3p7nWtGia4UzgUlVb4XdC+97RR5c1GQy5
YH82EdsMiDmkNfFi2a6RKy2YqpZxw8vHZCx7CXxSneUM//bMNA9HZZ5proZ9M04N
124xs+kJhGM1WSkrPaGy8NL7DgLOePQZ8yOiEllnV0eKtyWBtjuaSl6XH4QkF14D
v9ZqmLiN8MireWUSftDH4nFv5i36295Q7QU0mgK1Jlw722DQV4INCp9yzKStkg3J
FENGiapVglkmyGdb94dm2OtmwD3vNoX+Zi1/kZWE5pRYa9EpiJXTulMf2mP09RHU
pkQeLqYkFaXjHOq26ybpZlXhxIXsZLsV5qdWSQNeJR1BL2Wf+VGr04C5NmunX0nL
QIixnSjqRwfsG8e+3YhJxIRLGZEtU8aYarbrmf56ibklNHVhfCJHhOdgz+5ldl1U
47L+2tw5y9ntEHUuXGnFiQAMplF9o4i0pyiPB9NDLL7yLLSLIdgmP32flV2YHbOb
Hb9W+ZtDuehfFPcEgwUHj+FuAgWZ5jRWBwwFfT4VxycxNaKYGnYPuJWjmleZBQAR
AQABiQIlBBgBCAAPBQJYGRBaAhsMBQkHh3EAAAoJEEmxmzsSk7/HEREP/jQwNaOB
HlTzxrEwvlMFUT/7kenexe0LpEifJLUkQnaftwhdVdFzUS4itsSR6aUTIA6CMRp+
PeH3OMQCewKuy6JnWik7fZQgSZpW3K5hVfJ2txRyB8KK/unxPMFD07rZI23EQUX7
uHJtfOz/IZu/ESj/46DoBTkk+VZOw2aqOswjLzAI8NO6x84FK/jFcGlsX7p5kyyi
ZwlVYYAJ8UcQ68f3OP+erztPO6J2C9QZi4iVHooLZeciAw90WVSAv+dyEmZg/OvX
PhMe3GB2UnnBQZr7+lAOJBkpInPAp9Ol80Ht6482KyPpKnrmZek6c44rEVO5PKap
2nSpDq0eqQsxtFivFZ7Ittf1QmYIr9VFvQzrEw2nJJrshCkwCgDecjk1/8ldMKkH
qI6Pk7M2XC8QYjwhctcLq5OsO0no0LjW2okNxnIfOjvJTLKO+TFx4D9HulKxBT0b
eaUVFviXnzmRXFeoVj0weXKhK8mZ9Cvtd6OLPf4xG8ToESgr6Ri5k452N7fSh/X9
fPyq3KR/U03GBk1Dr2r68jz5+X5ZdS+JYogySbspFjPH0wtlyv9BqrHM1WfQqbTQ
YgOgCSljUV0oTYisDdAGS/EAXbodj/8ojkb9+7iPtHeg7YaGwc9ny5zQkzFj4rPh
c/8qjPcrlPl1HpoitsZOxmNrVxpj05+w6ZTm
=sO14
-----END PGP PUBLIC KEY BLOCK-----