Security at Motrix Cloud

Motrix Cloud is purpose-built for Florida paratransit and government fleet agencies. Security and data protection are not afterthoughts — they are foundational to every layer of the platform, from infrastructure to application design.

Transporting riders? Any plan can run in Client Code mode, which keeps rider names, phone numbers, and addresses out of Motrix entirely. Don’t enter rider PHI in a standard plan; see HIPAA status for details.

Security Assessment

The product reference documents a March 2026 security assessment. A formal penetration test was conducted in March 2026 following OWASP Testing Guide v4.2 methodology. The assessment returned an overall risk rating of LOW, and all critical findings have been remediated.

• Overall risk rating: LOW, with all critical findings remediated
• Multi-tenant data isolation verified across tenant boundary controls
• Most recent assessment: formal penetration test, March 2026 (OWASP Testing Guide v4.2)

Infrastructure & Application Security

The controls below reflect Motrix Cloud v2.15.1, released September 9, 2026. Request current evidence during your security review.

• Encryption in transit: TLS 1.3 with HSTS enforcement on all connections
• Security headers: All 6 recommended security headers deployed, including Content-Security-Policy and X-Frame-Options
• CSRF protection: Token-based protection on all forms and state-changing requests
• Access control: Role-based access control (RBAC) with per-agency tenant isolation
• Inspection integrity: DVIR inspection records are immutable once submitted (FTA compliance)
• Rate limiting: Logins limited to 10 attempts per minute; password reset emails rate-limited to prevent abuse
• Export safety: All CSV exports are sanitized against formula injection
• Registration control: Public registration is disabled; users are added via trial signup or invitation
• API surface: Authenticated application endpoints support documented workflows; confirm any external integration requirements with Motrix
• Session security: Cookies set with HttpOnly, Secure, and SameSite attributes
• Two-factor authentication: Standard TOTP (RFC 6238) with single-use recovery codes. Sign-in codes and recovery codes are consumed under a database lock so a code can never be replayed, and "remember this device" cookies carry a server-validated expiry
• Scoped access for department managers: Department restrictions are enforced at the model query, policy, and write layers — not just in the navigation
• Upload hardening: Inspection photo uploads are validated by file content, not just extension, and images are capped at 20 million decoded pixels (thumbnail generation enforces the same cap)
• Import integrity: CSV imports preview first and write nothing until confirmed. Confirmation tokens are bound to the user, company, and session, expire after 30 minutes, and are single-use; data is re-validated before any write
• Platform baseline: Laravel 13 on PHP 8.4+, with dependency vulnerability audits run in CI

Record Integrity & Audit Trail

• Immutable records at the data layer: Filed DVIR and PM inspections, rider-record access logs, readiness and defect-resolution history, and the parts stock-movement ledger are all append-only. Update and delete are rejected by the model itself, on every code path — not merely by the absence of an edit button
• Audited downloads: Document downloads and vehicle audit-packet exports are written to the access log; audit packets additionally require both fleet-management and report permissions
• Fail-closed auditing (HIPAA tier): If an access-log entry cannot be persisted, the read of a rider record fails rather than proceeding unlogged
• Retention over deletion: A company with retained audit or readiness records cannot be hard-deleted through the admin interface — it is deactivated instead, so the trail survives

Hosting & Data Residency

• Hosting provider: DreamHost, a US-based infrastructure provider
• Data residency: All customer data is stored on US-based infrastructure
• No offshore processing: Customer data is not replicated or processed outside the United States

Backups & Recovery

• Backup frequency: Nightly automated database backups using failure-sensitive pipelines — a partial or failed dump is never published as a good backup, and each backup is published atomically
• Scheduler safety: Scheduled jobs (alerts, trip generation, recall sync, backups) are guarded against overlapping execution
• Retention: Confirm the active deployment's backup retention policy during onboarding
• Encryption at rest: The paused HIPAA reference architecture specifies encrypted off-box backups; confirm controls for the active deployment
• Restore validation: Request the latest restore-test evidence; a logged restore drill is required before HIPAA onboarding resumes

Request Full Report