Security & Governance
How we protect vehicle data, manage access, and meet the requirements of European regulators and government data providers.
EU/EEA only
All processing and storage happens within the EU/EEA. No consumer-grade clouds.
Least privilege
Access granted only where required, reviewed periodically, and removed when no longer needed.
Encrypted, MFA-protected
Devices use encrypted storage. Multi-factor authentication on systems handling restricted data.
Government-data discipline
Data from authorities is used strictly within agreed boundaries and never transferred outside permitted environments.
This page summarises Good2Know's principles for governance, security, and privacy. It applies to all employees, contractors, and systems involved in handling vehicle data, including data provided by government authorities. The full internal policy is available to enterprise customers and government partners on request.
1. Data protection
Good2Know maintains a company-wide data protection policy that sets expectations for lawful, fair, and transparent processing of personal data, in line with the GDPR and applicable national legislation. Responsibilities, controls, and the framework for handling personal data are defined and reviewed.
2. Information security
Our information security policy establishes the principles for protecting information assets: confidentiality, integrity, and availability. It defines the baseline expectations that govern how systems, data, and resources are safeguarded.
3. Risk management
We follow a unified approach to security and privacy risk. Risks are identified and assessed at a principle-based level, with proportionate measures taken to address them. Risk evaluation is part of planning and operations, not an afterthought.
4. DPIAs and TIAs
Good2Know maintains principles describing when a Data Protection Impact Assessment or Transfer Impact Assessment is required. These ensure that GDPR obligations are evaluated whenever processing involves elevated risk or international transfers.
5. Records of processing
Processing activities are documented and kept up to date. Our Records of Processing Activities (ROPA) is maintained separately, with principles in place to ensure accuracy and ongoing compliance.
6. Government-provided data (including Traficom)
Data provided by Traficom and other government authorities is handled strictly within the boundaries set by applicable agreements and legislation. Specifically:
- Used only for permitted purposes
- Not transferred outside authorised locations or environments
- Processed only in environments under organisational control, governed by access, logging, and device controls
7. Access control
Access is granted on a least-privilege basis. Rights are assigned to individuals whose tasks require them, reviewed periodically, and revoked when no longer needed. Multi-factor authentication is required where appropriate, particularly for systems processing sensitive or restricted data.
Single sign-on with Google Workspace and Microsoft Entra ID. Your team signs in with the accounts your IT already manages, no separate passwords to create or forget.
8. Passwords, devices, and workspaces
- Passwords: meet minimum strength requirements and are not shared.
- Managed devices: access to restricted data is performed only through organisation-managed devices with encrypted storage, timely security updates, remote-wipe support, and compliance with device governance.
- Personal devices: not permitted for access to restricted or government-provided data.
- Clean desk & screen: systems are locked when unattended, and sensitive information is not left visible.
9. Cloud and hosting
Cloud services used by Good2Know operate within the EU/EEA and meet business-grade security requirements. We do not use consumer-grade cloud services for any restricted or government-provided data. All cloud environments operate under our access control, logging, and device governance expectations.
10. Hardening, segmentation, and protection
- Systems handling restricted data meet expected hardening standards.
- Network segmentation and filtering apply least-privilege and defence-in-depth.
- Vulnerabilities are assessed and addressed under defined principles.
- Malware protection and firewall rules are applied where appropriate.
11. Logging and monitoring
Activity in systems that process restricted data is logged. Logs include the information necessary to fulfil their purpose (timestamps, search parameters, actor identifiers) and exclude response payloads. Logs are:
- Retained for the minimum required period and as long as necessary
- Reviewed at regular intervals to identify irregularities
- Time-synchronised and protected against unauthorised modification or access
- Stored on systems with sufficient capacity to fulfil retention requirements
12. Incident response
Information security incidents — including any related to restricted or government-provided data — are logged and addressed in a timely manner. Where applicable, external reporting obligations are acknowledged and met in line with relevant requirements.
13. Removable media
Removable media is checked for threats before use, and automatic execution of content from removable media is not permitted.
14. Retention and deletion
Data is retained only as long as necessary for its purpose and deleted once that purpose has concluded. Retention principles apply to all data categories handled by Good2Know.
15. API security
Programmatic access to Good2Know systems is governed by:
- Authentication per user or per system
- Rate-limiting and anomaly monitoring, with automated protective restrictions on excessive or abnormal use
- Periodic credential rotation
- Logging of all API interactions in line with our logging principles
16. Suppliers and subprocessors
Only providers offering EU/EEA hosting, organisational-grade controls, and contractual security commitments may process restricted or government-provided data on our behalf. Supplier compliance is reviewed periodically. Onward transfer of data is prohibited unless explicitly permitted.
17. Business continuity
Backups are maintained as appropriate, and systems are designed to support recovery in the event of disruption. Our resilience principles set expectations for availability, integrity, and preservation of data during disruptions.
18. Oversight
Compliance with applicable requirements is monitored on a periodic, risk-based basis, in alignment with our internal governance expectations.
Document governance
This policy is maintained, reviewed, and updated in alignment with organisational requirements. It remains valid until superseded by a formally approved version. The full internal policy, including detailed control descriptions, is available to enterprise customers and government data partners under appropriate confidentiality terms.
Need our security documentation?
Enterprise customers, government data providers, and integration partners can request our full Governance, Security & Privacy Policy, alongside DPA and supporting documentation.
Contact us