Security at Yodeler

Fleet data is business-critical. Yodeler is built with a security-first posture across the platform, payments, and AI systems.

Platform security

• Encryption — TLS 1.2+ for all traffic; provider-managed encryption at rest for stored records.
• Authentication — server-verified credentials with signed, expiring session tokens; role-based access separates clients, providers, and administrators.
• Hardened headers — strict Content-Security-Policy, HSTS, clickjacking protection, and MIME sniffing protection on every page.
• Least-privilege APIs — billing and administrative endpoints require authenticated, role-checked sessions and are scoped to your own records.

Payments

All payments are processed by Stripe, a PCI DSS Level 1 service provider. Card data never touches Yodeler servers. Payment amounts are computed server-side from authoritative invoice records, and webhook events are cryptographically verified and processed idempotently.

AI assistant

Assistant requests are authenticated, rate-limited, and processed server-side — API keys are never exposed to the browser. The assistant only receives the fleet context belonging to your session.

Responsible disclosure

Found a vulnerability? We want to hear about it: security@yodeler.app. We commit to acknowledging reports within 2 business days and will not pursue action against good-faith research.

Roadmap

Formal SOC 2 Type II certification is on our compliance roadmap; contact us for our current security documentation and questionnaire responses.