Platform · Security and operations
Hosting, access and operations.
You hand us your vehicles, your customers and your brand. Here is how we look after them: who runs what, where the data lives, who may see it, and what we will never do. Your data stays yours, you decide who may see what, and every request is checked against that.
This page is being rebuilt, with the full version due in 2027. Until then, the figures for availability, recovery and testing are in the security pack, on request.
01Who runs what
Your brand. Operated by us.
No project team of yours is needed to keep it alive.
02Access
Nobody sees a vehicle by accident.
Three checks decide every request, in this order: who is asking, what the vehicle can do, and what has been sold.
1Permission
Who may see or do it
The role of this person, in this organisation, on this vehicle.
No: it stops here
2Capability
What this vehicle can do at all
Set per vehicle type. A function it cannot support is not offered.
No: it stops here
3Entitlement
What has been bought for it
What the organisation's plan includes switches its functions on.
No: it stops here
Roles per vehicle and sharing rules, checked on every request. Access and permissions →
03Where the data lives
In Frankfurt and London, under European law.
Production runs in Frankfurt. Your vehicles' data is hosted in Europe: Frankfurt, and London for some platform services. The main providers are listed below; the complete list is part of the data processing agreement.
- Data protectionGDPR and the Swiss data protection act
- Security managementISMS in place, preparing for ISO 27001 certification
- Security pack →Policies and answers, on request
- System status ↗Live availability, public
A certificate is named here when it exists, not before. Ask us for the current status and we answer in writing.
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting of the platform, its databases and backups | Frankfurt, Germany |
| Google Cloud | Hosting of platform services | Frankfurt, Germany |
| Akamai (Linode) | Cloud hosting of platform services | Frankfurt, Germany, and London, United Kingdom |
| Mapbox | Maps in the driver app and the portals | United States, map tiles only, no vehicle records |
| Stripe | Payments for services and subscriptions you sell | Payment data only |
Regulation and compliance
The EU Data Act, the Cyber Resilience Act, UNECE R155 and R156, NIS2, ISO 27001 and the rest: what applies, what we cover and what stays with you.
04Our commitments
Four things we will never do.
Written down, so you can hold us to them.
- Sell your data.Not to insurers, not to data brokers, not to anyone.
- Share it between manufacturers.One manufacturer never reaches another manufacturer's vehicles.
- Decide who your partners are.You grant access, you revoke it.
- Let AI see more than its user.A query, an agent or an assistant works with the permissions of the person asking, never more.
05How we build
How a change reaches you.
People and AI agents plan together. Agents design, build and review. People sign off at three checkpoints, and everything else is tested automatically. Every release can be rolled back.
AI-native, people accountableAI writes the majority of our code, but our engineers remain accountable and review every line.
People and AI
RoadmapWhat gets built, and why, from what manufacturers and their partners need.AI
DesignAgents draft the architecture, UX and UI.Checkpoint
Design signed offPeople check the plan before a line is written.AI
BuildAgents write the code, to the plan.AI
Review, in a loopAgents review each other's work until it holds up.Checkpoint
Code approvedAn engineer reads and approves every change.Automated
TestedEvery pull request runs the full regression, down to end-to-end tests on iOS and Android.Checkpoint
QA, test and demoPeople check it in test and demo environments.Automated
StagingA full rehearsal, tested and monitored like production.Automated
ProductionFor every manufacturer at once, versioned, so a release can be rolled back.
After it ships
Monitored constantly and fixed in minutes.
We monitor all metrics across test, staging and production. If anything deviates, an alert reaches us right away while an AI agent starts investigating.
- Test
- Staging
- Production
- Alert
A metric leaves its range, on any environment.
- Investigated
An AI agent looks into it and prepares the fix.
- Approved
An engineer checks it and ships it.
- Resolved
Usually within minutes.
Dependencies stay current. Updates arrive automatically, each with an impact analysis before it is merged.
One platform, one release. Every manufacturer runs the same version, so a fix reaches everyone the day it ships.
06Reaching security
Security contact
Found something? Tell us.
A vulnerability, or a security review of your own: we read every report and answer in writing. Pick "a security review" on the contact form, and our security.txt says the same for scanners.
07What procurement asks
Short answers, in writing.
Can we get our data out?
Yes. Everything the platform holds about your vehicles is available over the open APIs and as a stream, in the same shape your own systems read.
Who at c.technology can see a vehicle?
Support and engineering, when a case requires it, through the same permission system. There is no separate back door.
What happens when a customer asks to be deleted?
The person's account and personal data are removed. The vehicle's technical record stays with the vehicle, which is what the next owner and your warranty need.
Do you have a status page and an incident process?
Yes. Availability is public at status.ctechnology.io. Monitoring and alerting cover the platform, and we answer in writing what we do in an incident.
Does the EU Data Act change this?
It makes the access model a requirement rather than a feature. Ours already works per organisation, per vehicle, revocable. The Data Act in detail →
Where to go next