Damoov was named Vehicle Telematics Innovation of the Year in the 2026 AutoTech Breakthrough Awards.

Pricing
Contact
Get Started

Damoov IT Security policy

Effective August 2019; last updated August 2022

Policy objectives

This Policy and the framework are designed to:

  • Promote a holistic approach to information security management. 
  • Support Damoov’s information and technology against compromise of confidentiality, integrity (including non-reputation) and availability
  • Support Damoov’s strategic vision through an approach which effectively balances usability and security
  • Facilitate a ‘security aware’ culture across the company and promote that Information Security is everyone’s responsibility.

Scope of the Policy

The scope of the Information Security Policy covers the storage. access. transmission and destruction of the information in the course of Damoov business. It, therefore, applies to the conduct of employees and subcontractors’ employees with access to that information (whenever the information or they are located) as well as the applications, systems, equipment, and premises that create the process, transmit, host, or store information, whether in-house, personally owned or provided by external suppliers.

Governance

Responsibility for the production, maintenance, and communication of this top-level policy document and all sub-policy documents lies with Damoov’s CEO

This top-level policy document has been approved by the company board of directors. Substantive changes may only be made with the further approval of the BoD. Responsibilities for the approval of all sub-policy documents are delegated to the company CEO. Before approving any, sub-pollcy, the company CEO will consult with the company Executes as appropriate.

Each of the documents constituting the Information Security Policy will be reviewed at least once every three years. It is the responsibility of the company CEO to ensure that these reviews take place. It is also the responsibility of the company CEO to ensure that the policy set is and remains internally consistent.

Changes or additions to the Information Security Policy may be proposed by any member of staff, via the Architecture committee to the CEO.

Compliance with GDPR

Damoov acts as a Data Processor for the purposes of processing Personal Data. The company follows all instructions received from Data Controller in respect of Personal Data shall at all times be in accordance with the GDPR and the company’s Data privacy policy

Policy Enforcement

The enforcement or the security policy is the job of the Resource manager. The resource manager calls the Security Access Manager authorization service with the credentials of the user that makes the request. The call includes the type of access wanted and the object to be accessed. The credential provides detailed information, acquired during authentication, that describes the user, any group associations, and other security-related identity attributes. Credentials can be used to do a multitude of services, such as authorization, auditing, and delegation.

In our business, we rely on the security best practices from global leading companies whose services are used in our business:

Auth0

Identity provider:

  • Datahub access
  • API Access
  • M2M access

 

Auth0 documentation

Hetzner

  • Telematics platform

Hetzner Documentation 

Cloudflare

  • SSL
  • Encryption
  • End-point security

 

Cloudflare documentation

User responsibility

  • Users (End users, API users, Datahub users)
    Users are responsible for protecting the Damoov’s information and technology systems and for complying with this Policy and the Framework. If a user suspects or discovers any material breach of the requirements detailed within this Policy, they must report this using one of the available channels.

    Where an individual user suspects personal data may have been compromised, they must notify the Data Protection Officer (DPO) through the available channels.

Available channels: 
  • Datahub Support chat
  • Website support chat
  • Slack
  • Customer support portal
  • Employees
    Employees must accept that they carry responsibility when utilizing the Damoov’s facilities, technologies, or services and will take all reasonable steps to protect Damoov’s information and technology systems. Students will comply with this Policy and the Framework, where required
  • Subcontractors
    Subcontractors are expected to comply with the requirements of this Policy and Framework. Failure to do so may result in the withdrawal of access to Damoov information assets and technology.

Security weaknesses and vulnerabilities

An independent third party should perform external and application penetration testing at least once a year, and after any significant infrastructure or application upgrade or modification. These penetration tests should include the following:

  • Network-layer/infrastructure penetration tests.
  • ApplIcation-layer penetration tests
  • Attestation of successful completion. including the remediation of any findings.

Perform internal and external vulnerability tests at least quarterly. Ensure findings are addressed in a timely manner.

Address newly identified threats and vulnerabilities on an ongoing basis based on severity and skill level required to take advantage of the identified vulnerability

Ensure the following are implemented:

  • Static code testing
  • Dynamic code testing of the test and production environment
  • Manual testing after any significant changes
  • Processes to ensure that security vulnerabilities identified as Severity 2 or higher are not released into the production environment.

Password policy

Passwords are managed by Auth0 identity services, however, the following security requirements should be adhered to when creating passwords:

  • Minimum if eight (8) characters in length. containing characters from the following three categories:
    • English uppercase characters (A through Z)
    • English lowercase characters (a through z)
    • Base 10 digits (0 through 9)
  • The use of non-alphabetic characters (e.g.,!, $, #, %) is optional but is highly recommended.
  • Passwords history should be kept for the previous six (6) passwords and passwords should be unique across the password history.
  • The maximum password age is ninety (90) days.
  • Must not be the same as or include the user id or be visible when entered
  • Must not be easily guessable.
  • Set first-time passwords to a unique value for each user and change immediately after the first use.
  • User accounts should be locked after seven 7 incorrect attempts
  • Lockout duration should be set to a minimum of thirty (30) minutes or until an administrator resets the user’s ID.

Data Encryption.

Each application Is accessed via HTTPS using Transport Layer Security, (TLS). TLS Is a cryptographic protocol designed to protect information transmitted over the internet, against eavesdropping, tampering, and message forgery

Anti-virus software

The IT Department shall carry out regular vulnerability assessments. and utilize patch management, threat protection technologies, and scheduled monitoring to identify assess, mitigate and protect against identified security threats. viruses end other malicious code:

  • The IT Department shall ensure that the Company uses an up-to-date reputable anti-virus checking software tool to check the IT Systems and to scan all email attachments before they are opened.
  • Uses may download files from any cloud storage systems, subject to prior approval from the IT Department; and Users shall permit any such files to be scanned for viruses as part of download process
  • The IT Departament shall implement network security controls that provide for the use of enterprise firewalls and layered MDZ architectures, and intrusion detection systems and other traffic and event correlation procedures designed to protect systems from intrusion and limit the scope of any successful attack.

General software

Software
All software installation on to the IT Systems shall be the responsibility of the IT Departement. Users are not permitted to install any software on to the IT Systems unless expressly approved in writing by the IT Department.

All software installed on to the IT Systems shall be kept sufficiently up to date in order to ensure that the security and integrity of the IT System are not compromised.

Physical/ Hardware Security
All Company mobile devices (including. without limitation, laptops, tablets and mobile telephones) should be kept securely by Users using secure cases where appropriate. Users should not leave such mobile devices unattended other than at their home, or Company premises.

  • All Company non-mobile devices (including, without limitation, desktop computers, workstations, and monitors) shall, wherever possible and practical, be secured in place with a suitable locking mechanism.
  • Users are not permitted to connect any of their personal hardware to the IT Systems without the express approval of the IT Department in writing

Working from home/remote working

Users must note that when using home PCs or other equipment at fixed locations outside the company office, they are operating outside the company security perimeter

It is the responsibility of users to ensure that PCs used for home working are themselves properly secured. Weak security on home PCs used for home working could lead to the compromise of their account and result in security incidents involving the company IT systems.

Users are responsible for the safeguarding of equipment against unauthorized access, misuse, theft, or loss when in their home or in transit. Where home computers are used by other family members, no organizational information should be accessible by such unauthorized parties

Users must ensure that all reasonable protection measures are in place and operating where applicable, as follows:

  • The computer’s local Firewall should be enabled
  • Anti-virus software should be installed and automatically update itself
  • Anti-spyware software should be installed to provide continuous protection against malicious software being downloaded
  • Up to date security patches should be installed for both the operating system and applications when released by software vendors and set to automatically update itself
  • Wireless networks at home must be properly secured against eavesdropping and intrusion.

Users must comply with the security requirements of this document at all times and where personal data is being processed, they must also comply with the Data Protection Policy.

Users must not access internal or confidential/sensitive information over unsecured broadband or public wireless networks as these present a security risk. Users should also be aware of the physical environment when working remotely ensuring no one is looking over their shoulder at information on screen.

Physical Security

Not applicable as we use cloud-based solutions.

Responding to Security Breaches

Security Incident handling procedure
As in all cases of security while the company endeavors to do everything it can to prevent the attacks and outcomes described the preventative measures are not always successful. In the case of a successful attack being perpetrated the following steps will be taken in each case:

  • Data loss (deleted from the active system)
    Data will be restored to the active system using one of our backups.
  • Data integrity breach
    Data on the active system will be compared to back up data and overridden with the backup data if a change is suspicious
  • Data theft
    In accordance with advice from the COi Information Commissioner’s Office) in their document ‘Guidance on data security breach management Individuals and organizations affected by the theft of company data will be informed as soon as possible with advice on what they should do to protect themselves from the stolen data being used against them
  • Virus / Malware detection
    Attempts will be made to establish what the virus/maiware is. what it is doing and where it came from before being removed.
  • Physical Theft/Damage
    The Equipment will be replaced as soon as possible to prevent disruption to the operation of business.
In any case of a breach of security, the root cause will be found and steps put in place to prevent the same kind of breach from happening again.

If a user or employee suspects or discovers any l breach of the requirements detailed within this Policy, they must report this using one of the available channels:

  • Datahub Support chat
  • Website support chat
  • Slack
  • Customer support portal

Policy Violation Procedures

Any staff member found in violation of this policy will be subject to the company’s disciplinary procedures and where in violation of the law will be reported to the relevant authorities. Due to the varying severity of such violations, the action taken by the company will be judged on a case-by-case basis.