/security

Security and IT review

Last reviewed 29 August 2026 · owner: engineering · questions to contact@milestracking.com, answered by the people who built it

This page exists so an IT reviewer can finish in one sitting. It is written as a document. If something you need isn't here, ask and we'll add it here rather than answer it privately.

1. Where the data lives

Almost everything runs on Cloudflare: the static site on Pages, the API and feed endpoints on Workers, live vehicle state in Durable Objects, the model and position history in D1, and the GTFS files in R2. Data is stored in the United States.

There is one exception, and it is architectural rather than incidental. GPS trackers open a raw TCP socket and stream binary frames; Cloudflare Workers cannot accept inbound raw TCP. So device ingest runs as a long-running process on a small Linux VPS that we administer. It terminates the device connections, decodes the frames, and forwards each position to the Workers API over HTTPS with a shared-secret signature and a replay window.

Trackers never reach Cloudflare and never reach your network. They reach that one host and nothing else. It runs no public web interface: the administrative UI is bound to loopback, and only the two device ports are published.

2. Subprocessors

This list is the whole list. We'll post changes here 30 days before they take effect.

3. What we collect

4. Retention

• Live positions: held in memory and served for the current service day.
• Position history: 90 days by default. Each customer elects its own period, 30 days to 3 years, to match its own records schedule. Exportable to you on request at any point inside it.
• Driver sign-in records: only while the shift is open. Ending the shift deletes the record.
• Staff account records: the life of the account. Billing records: as long as tax and audit rules require, then deleted.
• On cancellation: your data is exported to you and hard-deleted within 30 days of confirmed receipt. Backups expire at most 30 days after that.

5. Covered telecommunications equipment

No equipment or services from the entities named in 2 CFR 200.216 — Huawei, ZTE, Hytera, Hikvision, Dahua, or an entity designated under the statute — appear anywhere in this stack: not the trackers, not the hosting path, not the SIMs. We give you the assurance as a signed one-page letter, and it names the manufacturers and their countries rather than asking you to take our word: Teltonika Telematics (Lithuania) and Queclink Wireless Solutions (Shanghai, PRC). Neither is a covered entity — the rule names companies, not countries — and if your own policy is stricter than 2 CFR 200.216, say so before installation and we supply Teltonika only.

One thing we will not assert: we have not verified from published documentation which cellular module is inside a given tracker. It does not change the answer above, because no module vendor used in these devices is a covered entity. If your review needs module-level attestation, ask and we will obtain it from the manufacturer in writing.

6. The embed on your website

• One script tag that mounts an iframe. It reads nothing from the host page.
• The frame is sandboxed without allow-same-origin, so it runs on an opaque origin and cannot reach storage belonging to your site.
• No cookies, no local storage, no fingerprinting, no third-party requests beyond map tiles.
• It sets its own height and inherits your width. It doesn't touch your styles or your DOM outside its own node.
• We'll give you the exact CSP directives to allow it. Note that a policy of frame-src 'self' will block it, and we have not yet tested against one. Tell us your policy and we'll work it through with you rather than guess.

7. Limits we'll state plainly

• We publish no uptime percentage. Our own dependencies don't give us one to pass through. The service level we'll commit to is freshness: positions under 90 seconds old during service hours.
• We hold no SOC 2 report today. What we have instead: a written information security policy, an incident response plan, a data retention policy, and self-assessments against NIST CSF 2.0 and the Cloud Security Alliance's CAIQ v4. Ask and we send them. Our infrastructure providers' own certifications (Cloudflare holds ISO 27001, SOC 2 Type II, and PCI DSS) cover the layers we build on.
• The accessibility conformance report is published in full, including the one WCAG 2.1 AA criterion the product does not meet and the screen-reader pass we have not yet run: read it here.
• We are a small company. Bus factor is a fair question and we'll answer it, including what happens to your feeds if we stop operating.