Security and data protection
Your fleet's records, kept in India and logged.
PRACHSO holds the registration records of your trucks and the licences and mobile numbers of your drivers. Here is where that data lives, how it is read, who can see it, and how you take it with you.
Reminder sent09:02
System
PUC due 19 Nov, MH 04 II 8820 to Sandeep Patil, WhatsApp, Marathi
Registry read08:47
System
PB 08 IO 2291, vehicle record, authorised channel, 1 record
Document uploaded08:31
Ramesh Verma, Munshi, Indore
Insurance policy, UP 32 OO 7710, version 3 replaces version 2
Role changed08:12
Gurpreet Sandhu, Owner
Anil Mehta: Branch manager, Bhiwandi only
ExportYesterday 18:40
Gurpreet Sandhu, Owner
All vehicles, Excel, 8 rows
Consent recordedYesterday 17:05
Bhupinder Kaur, Driver
WhatsApp opt-in, Punjabi, replied YES
Security at a glance
- Where data is stored
- India
- Encryption
- In transit and at rest
- Registry reads
- Per record, every read logged
- Access
- By role and by branch
- Audit trail
- Every change, upload and reminder
- Export
- Excel and PDF, any time
Authorised channels
We read records. We never scrape them.
Every vehicle and licence record comes through a channel that permits it, one record at a time, for a vehicle or driver the fleet has added. Each read is logged with the account, the record and the time.
PRACHSO does not build bulk copies of registry data, does not resell it, and is not VAHAN, SARATHI, Parivahan or any government service.
| Channel | What it provides | Basis |
|---|---|---|
| ULIP | API access for registered companies to logistics datasets, including vehicle and licence records | Per-record request, logged |
| Parivahan, VAHAN and SARATHI services | Services available to registered users, used one record at a time | Per-record request, logged |
| DigiLocker | Documents the holder chooses to share | The holder's consent for each request |
| Licensed data partners | Partners that hold their own authorisation to provide vehicle records | Written terms, per-record, logged |
Role-based access
Each person sees what their job needs
Branch staff see only their branch. Drivers see only their own Roadside Pack, through a link, without an account. Owners decide who holds every role.
| Action | Owner | Admin | Branch manager | Office user (munshi) | Driver | Gate operator |
|---|---|---|---|---|---|---|
| See vehicles, dates and documents | Yes | Yes | Own branch | Own branch | Own pack only | No |
| Upload or replace a document | Yes | Yes | Own branch | Own branch | No | No |
| Assign and close renewal tasks | Yes | Yes | Own branch | Own branch | No | No |
| See challans and driver attribution | Yes | Yes | Own branch | Own branch | Own pack only | No |
| Add or remove users, change roles | Yes | Yes | No | No | No | No |
| Export data to Excel or PDF | Yes | Yes | Own branch | No | No | No |
| Run a Gate Check on a hired truck | Yes | Yes | Own branch | No | No | Yes |
| Billing and plan changes | Yes | No | No | No | No | No |
Personal data
Owner and driver data under the DPDP Act, 2023
Who decides, who processes
For the vehicles, drivers and staff in your account, your company is the Data Fiduciary and PRACHSO is the Data Processor. We process names, licence numbers and mobile numbers only to track validity, send reminders and record challans, on your instructions. Our data processing agreement sets out every obligation.
Consent on record
Each WhatsApp opt-in and each DigiLocker consent is stored with its date, channel and wording. A driver who replies STOP gets no more reminders.
Kept out of analytics
Vehicle numbers, licence numbers, names and mobile numbers never go to analytics tools. Only event names and coarse properties do.
Rules status, stated carefully
The Digital Personal Data Protection Rules, 2025 were notified in November 2025 and come into force in phases. We align our notices, consent records and breach procedures with each phase as it commences, and follow the IT Act, 2000 and its reasonable security practices rules in the meantime. Data principals can raise a grievance with our grievance officer.
Audit trail
Every change has a name and a time
Uploads, edits, role changes, exports, reminders sent and registry reads all land in one trail that owners and admins can filter by branch, vehicle or user.
- Documents keep their version history, so a replaced policy is never lost.
- Trail entries cannot be edited or deleted by any user, including owners.
Reminder sent09:02
System
PUC due 19 Nov, MH 04 II 8820 to Sandeep Patil, WhatsApp, Marathi
Registry read08:47
System
PB 08 IO 2291, vehicle record, authorised channel, 1 record
Document uploaded08:31
Ramesh Verma, Munshi, Indore
Insurance policy, UP 32 OO 7710, version 3 replaces version 2
Role changed08:12
Gurpreet Sandhu, Owner
Anil Mehta: Branch manager, Bhiwandi only
Data export
Your data leaves when you ask
Export every vehicle, driver, date, task and challan to Excel, and every vehicle file to PDF, at any time. If you leave, the export stays open for 60 days before deletion.
On demand
Owners and admins export any time from the app. Branch managers export their branch.
On exit
Reminders stop. Export stays available for 60 days.
After 60 days
Data is deleted, except invoices kept for tax law.
Do you hold SOC 2 or ISO 27001 certification?
No. We do not claim a certification we do not hold. We describe our controls on this page, answer security questionnaires in writing, and will publish any certification here only once it is awarded.
Where exactly is our data stored?
On servers located in India. The cloud region will be named on this page once it is final. WhatsApp message content passes through Meta's WhatsApp Business Platform for delivery.
Can a driver see other drivers' documents?
No. A driver opens only their own Roadside Pack: the current documents for the truck they are assigned to today and their own licence. They never log in to the office app.
Do you scrape VAHAN or Parivahan?
No. Records are read one at a time through authorised channels, and every read is logged with the account and time. PRACHSO is not VAHAN, SARATHI or any government service.
What happens to our data if we leave?
Reminders stop, your data stays available for export in Excel and PDF for 60 days, and it is then deleted, except invoices that Indian tax law requires us to keep.
How do I report a vulnerability?
Write to security@prachso.xyz with the steps to reproduce. We acknowledge within 2 working days, keep you updated, and will not take action against good-faith research that avoids other customers' data.
Ask us the hard questions first.
Bring your security questionnaire to the demo. We walk through access, logging and export on your own fleet.