What we store, for how long, and who can reach it.
Delivery operations run on three kinds of data - about the delivery itself, about the rider, and about the recipient. Each has its own retention window, its own access rules and its own removal path. Nothing is stored longer than it earns its keep.
Three classes. Different rules for each.
Delivery data
Order metadata, origin and destination, window, SLA tier, rider assignment history and outcome. Retained for 24 months at operational resolution, then aggregated to corridor statistics.
Rider data
Rider identity, credentials, shift history, and performance metrics. Retained for the length of the working relationship plus 12 months for statutory records, then removed.
Recipient data
Recipient name, phone number and delivery address, as required to complete the order. Retained for 90 days at contact resolution, then reduced to postal-area analytics.
In transit and at rest.
All traffic between rider apps, dispatcher board, customer tracking pages, and the engine is served over TLS 1.2 or higher. All persistent data - operational database, backups, and analytics store - is encrypted at rest with keys rotated on a defined cadence.
- TLS 1.2+ enforced end-to-end, no plaintext transport
- AES-256 at rest for operational database and backups
- Key rotation on a documented cadence, with per-tenant separation
- Secrets managed through a dedicated vault - never in code
Access model
Fleet manager
Sees the whole operation - all clients, riders, corridors, analytics, escalations. Change access requires a second manager to approve.
Dispatcher
Sees the live board and can hold or reassign orders manually. Cannot change SLA, pricing, or user access.
Client admin
For courier-company setups only. Sees their own orders, their branded pages, their SLA report - not other clients' data.
Rider
Sees only their own path and current assignments. No visibility into other riders' routes or fleet analytics.
How the platform is run day to day.
Least-privilege access
Internal engineering has no default access to customer operational data. Access is scoped, time-bound, and logged when granted.
Audit logging
Every reassignment, every SLA override, and every access-elevation event is logged and retained alongside operational data.
Backup and restore
Operational database is backed up on a defined schedule with point-in-time recovery. Restore drills happen on a documented cadence.
Monitoring
Engine health, latency, and reassignment behaviour are monitored continuously. Anomalies raise alerts, not silent slowdowns.
Vendor discipline
Third-party subprocessors are documented, kept to the minimum, and reviewed against the same access model as internal systems.
Incident response
Documented playbook, defined escalation, and honest customer communication - a status page, not a silence.
Stated honestly, not overclaimed.
We describe what we do today, not what we would like to claim. The controls listed above are actively in place. Certifications that are in progress are called in-progress; the ones that are complete are named specifically. If a compliance question you care about is not covered here, ask - we prefer a straight answer to a marketing one.
- Data handling designed against India's Digital Personal Data Protection framework
- Data-processing addendum available for enterprise contracts
- Independent security review scheduled annually
- Named engineering owner for security posture on Enterprise contracts
Removal path
You raise a request
Signed request from a fleet manager or authorised admin, listing the class of data to be removed and the scope.
Acknowledged
Named security owner responds within one business day with the plan and estimated completion window.
Removal
Operational data cleared from live systems and analytics store. Retained only where a statutory obligation applies, called out explicitly.
Signed certificate
A dated confirmation is issued describing what was removed, from where, and what remains under statutory retention.
Security question we did not answer here?
Ask directly. We would rather send a specific answer than a marketing sheet.