Account and request protection
- Passwords are hashed by Laravel and are never stored as plain text.
- State-changing browser requests use CSRF protection and sensitive endpoints are rate limited.
- User-owned GPS, ELD, operations, and privacy records are checked against the authenticated account.
- Application sessions use secure, HTTP-only cookies in production.
Private records
- Driver-photo evidence is encrypted before private local storage.
- Portable data exports are private, expire after seven days, and can only be downloaded by their owner.
- GPS and ELD changes create database audit records where those workflows are enabled.
- Public web requests cannot directly browse private application storage.
Production safeguards
- The application runs with debug output disabled and cached production configuration.
- Host validation, server-side input validation, and explicit proxy boundaries reduce common request attacks.
- Map tiles and geocoding use controlled same-origin gateways with caching and upstream rate protection.
- Dependencies and automated tests are checked as part of deployment verification.
What is not represented
- OO Toolkit does not currently perform facial recognition or biometric identity matching.
- The service is not represented as an FMCSA-registered ELD or as independently security certified.
- Routing and record-keeping aids do not replace driver judgment, carrier procedures, or regulatory review.
- No system can guarantee absolute security; report suspected issues promptly.
Reporting a security concern
Email security@ootoolkit.us with the affected URL, a concise description, and safe reproduction steps. Do not include passwords, private keys, or another person's data.