Security

1. Security Overview

At RouteWise, security is foundational to everything we build. As a platform managing sensitive student transportation data, we maintain rigorous security practices that exceed industry standards. Our multi-layered security approach protects your data at rest, in transit, and during processing.

2. Encryption

2.1 Data in Transit

All communication between your browser, our APIs, and our servers is encrypted using TLS 1.3 (Transport Layer Security). We enforce HTTPS across all endpoints with HSTS (HTTP Strict Transport Security) headers to prevent protocol downgrade attacks.

2.2 Data at Rest

All stored data is encrypted using AES-256 encryption. Database backups, file storage, and log archives are encrypted at the storage layer. Encryption keys are managed through AWS Key Management Service (KMS) with automatic key rotation every 365 days.

2.3 Password Security

User passwords are hashed using bcrypt with a work factor of 12, making brute-force attacks computationally infeasible. We never store plain-text passwords, and password hashes are stored separately from user profile data.

3. Infrastructure Security

3.1 Cloud Infrastructure

RouteWise is hosted on Amazon Web Services (AWS), leveraging their enterprise-grade security infrastructure. Our deployment uses:

• Virtual Private Cloud (VPC) with network segmentation isolating application, database, and cache layers
• Web Application Firewall (WAF) protecting against OWASP Top 10 vulnerabilities
• DDoS protection via AWS Shield Standard and CloudFront CDN
• Private subnets for database and backend services with no direct internet access
• Security groups implementing least-privilege network access controls

3.2 Application Security

• Role-based access control (RBAC) with granular permissions per tenant
• Multi-tenant isolation ensuring no cross-tenant data access
• Input validation and sanitization on all API endpoints
• Rate limiting on authentication and public-facing endpoints
• CSRF protection and security headers (CSP, X-Frame-Options, X-Content-Type-Options)
• Automated dependency vulnerability scanning via GitHub Dependabot

3.3 Monitoring and Incident Response

Our infrastructure is continuously monitored with automated alerting for:

• Unauthorized access attempts and suspicious authentication patterns
• Unusual data access patterns or bulk data exports
• Application errors and performance degradation
• Infrastructure health and availability

We maintain a documented incident response plan with defined severity levels and escalation procedures. Security incidents are communicated to affected customers within 72 hours of confirmed discovery, in compliance with GDPR notification requirements.

4. Compliance Certifications

RouteWise adheres to the following standards and regulations:

5. Data Handling

5.1 Data Isolation

Each customer's data is logically isolated at the database level using tenant-specific identifiers. Queries are scoped to the authenticated tenant, preventing cross-tenant data access. Database access is restricted to the application layer through service accounts with least-privilege permissions.

5.2 Backup and Recovery

We perform automated database backups every 6 hours with point-in-time recovery capability for the last 30 days. Backups are stored in a geographically separate AWS region and encrypted with AES-256. Our Recovery Point Objective (RPO) is 6 hours and Recovery Time Objective (RTO) is 4 hours.

5.3 Data Deletion

When a customer terminates their account, we retain data for 90 days to allow for data export requests. After this grace period, all customer data is permanently deleted from primary storage. Backup data containing the deleted customer's information is purged within 30 additional days as backups cycle through retention.

5.4 Access Controls

Internal access to production systems and customer data is restricted to authorized personnel through:

• Multi-factor authentication (MFA) required for all infrastructure access
• Role-based access with principle of least privilege
• Audit logging of all administrative actions
• Quarterly access reviews with immediate revocation for departing team members
• Separate production and development environments with no shared credentials

6. Vulnerability Management

We maintain a proactive approach to identifying and addressing security vulnerabilities:

• Automated dependency scanning with alerts for critical vulnerabilities (patched within 24 hours)
• Static application security testing (SAST) integrated into CI/CD pipeline
• Regular penetration testing by qualified third-party security firms
• Responsible disclosure program for external security researchers

7. Responsible Disclosure

If you discover a security vulnerability in our Service, we encourage responsible disclosure. Please report findings to:

We commit to acknowledging reports within 48 hours and providing a resolution timeline within 5 business days. We will not take legal action against researchers who follow responsible disclosure practices.