Privacy & Trust
Privacy isn’t a feature we added. It’s how the data is stored.
Precise location is sensitive personal information. Traffica separates anonymous road data from identified data, protects both by construction, and tests the protections against ground truth.
Two kinds of data
Anonymous road data and identified data never mix
Shared products are built only from pseudonymous V2X data. Identified data is stored separately, per organization, and the database enforces the separation.
Shared road data
V2X probe data behind every aggregate product
- Raw vehicle IDs are never stored. Each is replaced by a keyed pseudonym that changes every day.
- Pseudonyms are never linked across the vehicle’s own ID rotations; doing so would defeat the V2X privacy design.
- Path history and predicted paths are dropped on arrival.
- A cell is published only with at least five distinct vehicles; smaller cells are stored but suppressed.
- Trajectory fragment endpoints are trimmed, and sensitive sites are suppressed.
Identified data
An organization’s own phones and telematics units
- Stored only when a consent grant covers the data category: location, driving events or vehicle signals.
- Visible only to the organization that collected it, and never used in shared products.
- People are known only by an opaque reference: no names, emails or phone numbers.
- VINs are encrypted, searchable only within one organization, and shown as the last four characters.
- Without trip-history consent, nothing within 200 m of a trip’s start or end is ever shown.
Controls
Rights and limits that work without anyone remembering them
An append-only consent ledger
Each grant records purposes, data categories, notice version and evidence. Grants are never edited or deleted, only revoked once, and consent is read on every upload.
Access and deletion
Export everything held about a person as one file. Deletion stops ingest at once, then removes data in two passes minutes apart to catch uploads in flight.
Retention with ceilings
Organizations choose retention per data class, within hard limits the platform enforces. Expired data is deleted every hour.
Isolation in the database
Explicit filters in every query, backed by row-level security and tenant views. The API’s database role cannot read raw telemetry at all.
An audit trail that can’t leak
Admin changes and identified-data reads are recorded append-only, with IDs and counts, never coordinates, VINs or external references.
Staff access, limited
Traffica staff can help administer an organization, always audited, but never read its identified telemetry or exports.
Tested, not assumed
Privacy rules have test results too
Privacy guarantees are checked the same way as speeds and trips: against ground truth and with automated tests that run on every change.
- raw vehicle IDs found when every column of every table was scanned
- 0
- protected positions within 200 m of a person’s true trip endpoints
- 0 of 5,875
- revocations that stopped ingest at the very next upload
- 16 of 16
- audit rows containing a VIN or an external reference
- 0
Security
Secured from the roadside to the API
Verified at the edge
IEEE 1609.2 message signatures are checked at the roadside unit or hub; each site records whether verification is confirmed.
Device keys, not shared secrets
Devices prove themselves with enrolled public keys, through short-lived single-use tokens or mutual TLS. Revocation is immediate.
Safe invitation codes
Single-use, expiring codes stored only as hashes, never logged, with rate limits on every lookup.
Secure engineering
Threat analysis aligned with ISO/SAE 21434, a software bill of materials, dependency scanning and architecture tests in CI.
Retention
Kept only as long as it’s useful
Defaults below, to be confirmed with counsel for each deployment. Organizations set identified-data retention within these bounds.
| Raw V2X points | 30–90 days |
|---|---|
| V2X events | 1 year |
| Aggregates | Kept |
| Identified positions & signals | 14–90 days (default 90) |
| Identified events | 30–365 days (default 365) |
| Trips & journeys | 30–365 days (default 90) |
Security roadmap
What we’re adding next
- Managed key storagePseudonym and VIN keys move to a key-management service, with daily pseudonym keys destroyed when raw data expires.
- Independent penetration testIncluding tenant isolation, by an outside firm.
- Legal reviewRetention periods, consent language and the insurance-scoring posture, with counsel.
- App attestationSo only the genuine driver app can redeem invitation codes.
Standards
Aligned with the standards and laws that apply
Traffica is designed around these standards and regulations. None of this is a certification claim.
| Standard | Area | How it applies |
|---|---|---|
| SAE J2735 (2024) | V2X messages | Basic Safety Messages, signal phase and timing (SPaT) and intersection maps (MAP). |
| SAE J2945/1 · J3161/1 | V2X performance | Message content and rates, rotating vehicle IDs for privacy, and the C-V2X deployment profile. |
| IEEE 1609.2 | V2X security | Message signing, verified at the roadside unit or hub before data reaches Traffica. |
| NTCIP 1218 · USDOT RSU spec | Roadside units | Roadside unit configuration and forwarding; the basis of our RSU registry. |
| COVESA VSS | Vehicle signals | Signal names and units for the canonical data model and identified uploads. |
| ISO 22837 · ISO 24100 | Probe data | Probe-data model and probe-data privacy: pseudonyms and trimmed trip endpoints. |
| ISO/SAE 21434 | Cybersecurity | Threat analysis and risk assessment, software bill of materials and dependency scanning. |
| CCPA/CPRA · state privacy laws | Privacy | Precise location treated as sensitive; consent, access and deletion built into the data model. |
| ISO 20078 (ExVe)Next | OEM data access | Pulling consented vehicle data from automaker platforms. |
| SAE J1979 · J1939Next | Diagnostics | Engine and diagnostic data through telematics partners. |
Want to go deeper on privacy?
We’re happy to walk your privacy, security and legal teams through the design in detail.