Security & trust
Security & privacy policies
These policies govern how the USIDA International Driving Permit platform protects traveler and staff data. They are aligned to the SOC 2 Trust Services Criteria (shown next to each section). The platform is preparing for a formal independent SOC 2 audit; attestation is issued only after an external auditor's examination.
1. Access control
SOC 2 CC6.1 – CC6.3- Access is role-based: platform admin, club admin, agent and viewer. Roles are stored separately from profiles and checked by the database on every request.
- Staff only see orders in their own USIDA region; travelers only see their own records.
- New staff access requires an invite or an approved request; access is reviewed annually and removed the same day someone leaves.
- Every staff sign-in is recorded with time, role and region.
2. Encryption & data protection
SOC 2 CC6.1, CC6.7, C1.1- All traffic is encrypted in transit with TLS. Stored data and files are encrypted at rest.
- License numbers, last and middle names and birth dates are additionally sealed with AES-256-GCM before they are saved, and searched through keyed fingerprints so the real value is never queried in the clear.
- Encryption keys are held as platform secrets, never in code, and are rotated at least yearly or immediately on suspected exposure.
- Card numbers never touch USIDA's servers; payments are handled by PCI DSS-certified processors.
3. Logging & tamper-evident audit
SOC 2 CC7.2, CC7.3- Every order step, license record action, sensitive-data reveal and automated Ava decision is logged.
- Log entries are sealed into a SHA-256 hash chain: each entry carries the fingerprint of the one before it. Entries cannot be edited or deleted, and staff can verify the whole chain at any time.
- Audit logs are retained for at least seven years.
4. Change management
SOC 2 CC8.1- All changes to the platform are version-controlled, reviewed and tested in a preview environment before publishing.
- Database changes are applied as recorded migrations; destructive changes require explicit approval.
- Inbound webhooks (payments, shipping) are rejected unless they carry a valid cryptographic signature.
5. Incident response
SOC 2 CC7.4, CC7.5- Suspected incidents are reported to the security lead immediately and triaged within 24 hours.
- Affected keys and accounts are revoked, the audit chain is verified, and root cause is documented.
- Affected travelers and USIDA operations teams are notified without undue delay and within the time required by law.
6. Vendor management
SOC 2 CC9.2- Sub-processors (hosting, payments, postage, email) are reviewed for their own security attestations before use and yearly after.
- Vendors receive only the data needed for their task — for example, the postage provider receives a shipping address, never a license number.
7. Data retention & privacy
SOC 2 P4.2, C1.2- Travelers' data is used only to issue, ship and support their permit.
- License images and documents are kept only as long as needed for issuance and legal record-keeping, then deleted.
- Travelers can ask to see, correct or delete their data by contacting USIDA support.
8. Availability & continuity
SOC 2 A1.2, A1.3- The database is backed up automatically with point-in-time recovery.
- Restores are tested at least twice a year.
- Scheduled jobs (renewal reminders, live-order checks) can also be run manually by national admins if automation fails.
Policy owner: Jens Albers, security lead · Reviewed yearly · Last updated September 2026