Trust & Security — How we protect your fuel data

The foundations

What everything else rests on

Hosting, encryption and tenancy. The rest of the platform sits on those.

Google Cloud

Built on Google Cloud

FuelDeck™ is built on Google Cloud and runs there. Nothing to install on your side, no new hardware to buy.

TLS 1.3 · AES-256

Encrypted in transit and at rest

Every ticket and record is encrypted in transit with TLS 1.3 and at rest with AES-256. Customer credentials are stored write-only and encrypted.

Per-tenant isolation

Your data, only yours

Each company's data is walled off from every other tenant's. Inside your company, access goes by role, and your configuration belongs to your company alone.

The controls in place

Seven controls, in plain words

What stands between your fuel data and anyone who shouldn't see it, from the cloud it runs on down to the record of who changed what.

Infrastructure

Built on Google Cloud. FuelDeck™ runs in the cloud, so you install nothing and run no servers of your own.

Google Cloud

Encryption

TLS 1.3 protects data in transit; data at rest is encrypted with AES-256.

TLS 1.3 · AES-256

Per-tenant isolation

Each company's data is kept apart from every other company's. No account can see another's tickets or ledger.

Per tenant

Role-based access

Every user works under a role, so people see and change only what their role allows.

Role-based

Per-company configuration

Your field rules and per-customer output mappings are configured for your company alone.

Per company

Credentials

Customer credentials for portals and feeds are stored write-only and encrypted.

Write-only

Audit logging

Every privileged action is logged. Administrative changes leave a record.

Audit log

Security at a glance

The short version

The things an information-security reviewer asks about first, in one table.

Hosting	Built on Google Cloud
In transit	TLS 1.3
At rest	AES-256
Tenancy	Per-tenant isolation
Access	Role-based access control
Configuration	Per company
Credentials	Stored write-only and encrypted
Audit	Privileged actions logged
Certifications	None held today. See the FAQ below
Single sign-on	Not available today

Data handling & privacy

What we process, and how it stays yours

FuelDeck™ works with the operational records of fuelling, and nothing beyond what that job needs. Here is what enters the platform and how it is contained.

What we process

Operational fuel data

What FuelDeck™ ingests is fuel records: Excel, CSV and PDF files from portals, feeds and email, plus ticket images, along with the airline schedules and flight data used to check them. We process what it takes to account for fuel. We do not profile people.

How it's isolated

Fenced to your tenant

Your tickets and ledger sit in your own tenant, and access within your company goes by role. No other customer can read or query your records.

How it's retained

Traceable, then yours to remove

Records stay as the traceable ledger your operations depend on, with the source document, review decisions and delivery status on every line, encrypted at rest with AES-256. Retention follows your agreement. Data can be exported or removed on request. The full detail is in our privacy commitments.

Read the privacy policy →

Security FAQ

Straight answers

What security and procurement teams ask us most often.

Where is my data hosted?

On Google Cloud. FuelDeck™ runs in the cloud, so there is nothing to install on your side.

Who can access my data?

Only authenticated users in your own company, and only what their role allows. Each company's data sits in its own tenant, and every privileged action goes into an audit log.

Is my data encrypted?

Yes. TLS 1.3 in transit, AES-256 at rest, for everything.

How do you handle credentials for our portals and feeds?

Customer credentials are stored write-only and encrypted, and privileged actions are audited.

How do you isolate tenants from each other?

Each customer's data lives in its own tenant, so no account can see another's tickets or ledger. Configuration is per company too, from field rules down to output mappings.

Do you hold SOC 2 or ISO certification, or offer single sign-on?

Not today, and we would rather tell you that plainly than dress it up. What we do have: Google Cloud hosting, per-tenant isolation, role-based access control, per-company configuration, audit logging of privileged actions, customer credentials stored write-only and encrypted, TLS 1.3 in transit and AES-256 at rest. We're happy to walk your security team through each one.

Talk to our team

Run FuelDeck™ past your security review

We'll take your security and procurement teams through each control in place, encryption, isolation, role-based access and audit logging, and show the platform working, live.

Book a demo