Statement of information security

Last update: 7 October 2026
Version: 2.1
To whom it applies: Customers, data holders and technical evaluators

In summary

We describe implemented controls, not aspirations, and we say what we don't have yet.
The isolation between customers is the main border and is applied in the data access layer.
An incident can also activate Act No. 21.719 and Act No. 21.663, with different time frames; we evaluate both.
To date we do not have external certification, and we declare it rather than suggest otherwise.
The platform is hosted on a dedicated Contabo server in France (European Union), behind Cloudflare.

This summary guides the reading and does not replace the text of the document.

01Approach

The security of Drometra is not an added module at the end: it is part of the platform architecture and crosses all its components, from the device in the vehicle to the interface. That decision is recorded in our architecture documentation and is why the isolation between customers is resolved in the data access layer and not in the presentation layer.

What we don't have?

To date of this document Drometra does not have ISO 27001 certification or SOC 2 report, and has not performed an intrusion test by an independent third party. We declare it because an evaluator deserves to know before asking, and because the sector abuses the certification language to imply audits that do not exist.

02Technical controls

Scope	Control	State
Hosting	Contabo GmbH virtual server in Lauterbourg, France (European Union); the origin is not exposed to the internet and is published only through a Cloudflare tunnel	Implemented
Transit numbering	TLS on all external traffic, terminated at Cloudflare; TLS 1.2 or higher between the application and the database and to the identity provider	Implemented
Encryption at rest: backups	Database copies encrypted before leaving the server and stored in a private Cloudflare R2 repository	Implemented
Encryption at rest: sessions	Console sessions are stored encrypted with AES-256-GCM	Implemented
Encryption at rest: server disk	Database volume encryption	Under evaluation
Isolation between customers	Mandatory row-level security in PostgreSQL: every query is scoped to the session's company	Implemented
Access control	Reader, operator, administrator, and driver roles, enforced in the database with least privilege	Implemented
Authentication	In-house identity provider (Keycloak); mandatory second factor; lockout after failed attempts; no self-registration	Implemented
Registration and audit	Action log with actor, company, request, action, and result	Implemented; retention period being defined
Container hardening	Read-only file systems, no Linux privileges, internal networks with no internet egress	Implemented
Administrative access to the server	Only with SSH keys and via VPN; remote superuser access disabled; default-deny firewall	Implemented
Backups	Encrypted physical copy with integrity verification and test restoration	Implemented on demand; automatic scheduling and retention being implemented
External intrusion test	For an independent third party, with a report that can be delivered to customers	Planned
Management system certification	ISO 27001 or equivalent	Not started

The platform records are issued without detailed coordinates, without Rut, without tokens, without signed URL and without video: a system of observability should not become a second copy without control of the data it protects.

03Organizational controls

Contractual confidentiality for every person with access to systems, remaining in effect after the relationship ends.
Access revoked within the same business day upon termination of an employment or service relationship.
Drometra staff access to customer data only for a recorded reason, limited in time and notified to the customer.
Development environments work with synthetic data; internal development-assistance tools do not index customers' personal data.
Privacy and security assessment of every provider before adding it to the processing chain, and publication in the subprocessor register.

04Security of field applications and devices

A phone or a device installed in a vehicle is outside our perimeter, in the hands of third parties, and may be lost or physically opened. We describe the status of each component separately.

Component	Control	State
Dromivia (Android app)	Session and PIN encrypted with AES-256-GCM and a key from the system's secure store (Android Keystore)	Implemented
Dromivia	Local database and evidence files encrypted by the app, in addition to operating system encryption	Being implemented; today only operating system encryption
Dromivia	Manifest with SHA-256 fingerprint per delivery, to detect tampering with the evidence	Implemented
Dromivia	Request signing and device attestation	Planned
Drometra Vision (lab)	Clips encrypted with AES-256-GCM on the phone once closed	Implemented in the lab
Drometra Vision	Separate identity per device, with revocable credentials	Planned
Third-party GPS trackers	Telemetry gateway with per-device identification	In development; not enabled in production

05Incident management

1.Detection and classification by severity, with immediate preservation of records.
2.Contención: close the access path, revoke credentials, block cachés and automatismos involved.
3.Determination of the scope: which data, which holders and what time interval.
4.Notification to the client concerned within 24 hours of confirmation.
5.Notification to the appropriate authorities within their respective time limits.
6.Correction, cross-checking and reopening of the service only after checking that the track is closed.
7.Subsequent root cause report and measures taken, submitted to the client concerned.

Two laws, two watches

The same incident can trigger the reporting duty of Act No. 21.719 to the Data Protection Agency and Act No. 21.663 to the National Cybersecurity Agency, whose time limits for essential service providers are considerably shorter.

Ley 21.663 · Cybersecurity Framework Act

It establishes risk management and incident reporting obligations for essential service providers and operators of vital importance, under the control of the National Cybersecurity Agency. Transport and logistics are among the sectors covered.

Official text of the rule

06Continuity and degraded modes

A system that only works when everything works does not serve an operation on the ground. The platform is explicitly degrade, and that is a security decision as well as a decision of availability.

Without a signal, the map shows the last known position and its antiquity, rather than presenting it as current.
The land application retains work locally to its stated limits, without promising immediate synchronization.
An integration with uncertain state leaves the record as a slope and disables the automation dependent, rather than a result.
The agent may be left without his tools by keeping the domain actions available, which do not depend on him.

Status of this document

Text prepared by Drometra and pending review by external legal advice before its final publication. Its structure and content were built on the current Chilean legislation and on Law 21.719, which has been in force since 1 December 2026. It does not constitute legal advice for third parties.