Audit Center

What is the Audit Center?

The Audit Center allows you to grant temporary, read-only access to your fleet data for external parties — insurance auditors, compliance reviewers, or regulatory inspectors. Instead of exporting and emailing spreadsheets, you issue a secure token that gives the auditor a live, read-only view of the data they need.

Issuing an access token

1. Navigate to Audit from the sidebar.
2. Click Issue new token.
3. Configure the token:

   • Label — a descriptive name (e.g., "Q1 2026 Insurance Audit — Allianz")
   • Expiry — choose from preset durations (24 hours, 7 days, 30 days) or set a custom expiry date and time
   • Scope — optionally limit the token to specific data types (incidents only, vehicles only, full access)
4. Click Generate token. Fleet creates a 64-character hexadecimal token and displays it on screen.
5. Copy the token and share it with the auditor through a secure channel (encrypted email, secure messaging, or in person). The token is shown only once — if you close the dialog without copying it, you will need to generate a new one.

How auditors use the token

When an auditor receives the token, they navigate to your Fleet audit URL (provided alongside the token) and enter the token string. They are then presented with a read-only view of your fleet data within the token's scope.

The auditor can:

• Browse incidents, vehicles, shifts, and maintenance records
• View photos and documents
• See timelines and status histories
• Export data as CSV for their own records

The auditor cannot:

• Modify any data
• Create, edit, or delete records
• Access billing, settings, or user management
• See data outside the token's defined scope

Managing active tokens

The Audit Center's main page lists all active (non-expired, non-revoked) tokens with their label, creation date, expiry date, scope, and last-used timestamp.

1. Review the list periodically to ensure no tokens are active longer than necessary.
2. Click on any token row to see its full details, including an access log showing when the token was last used.

Revoking access

You can revoke any active token at any time, immediately cutting off the auditor's access.

1. Find the token in the active tokens list.
2. Click the ... menu and select Revoke token.
3. Confirm the revocation. The token becomes invalid instantly — any auditor currently viewing data will be logged out on their next page load.

The security model

Fleet's audit token system is designed with the following security principles:

• 64-character hexadecimal tokens — cryptographically random, making brute-force guessing infeasible (256 bits of entropy)
• Time-limited — every token has a mandatory expiry. There is no "permanent" option. The maximum duration is 90 days.
• Revocable — any token can be revoked instantly by the owner, regardless of its expiry date
• Read-only — tokens grant view access only. No write, update, or delete operations are possible through an audit token
• Scoped — tokens can be limited to specific data categories, following the principle of least privilege
• Logged — every token usage is recorded with timestamp and IP address, visible to the owner on the token detail page

Best practices

• Issue tokens with the shortest practical duration — a one-week audit does not need a 30-day token
• Use descriptive labels so you can identify tokens at a glance months later
• Revoke tokens as soon as the audit is complete, even if they have not expired yet
• Review the active tokens list at least monthly and clean up any that are no longer needed
• Keep a record of issued tokens (who received it, why, and when) outside of Fleet for your own compliance documentation

Why the audit center matters

External audits are a fact of life for fleet operators. Insurance companies, Amazon DSP compliance teams, and regulatory bodies all want to see your records. The audit center lets you share everything they need without giving access to your live operational controls.

Time-limited, read-only tokens mean you never lose control. You decide exactly how long the auditor has access, and you can revoke the token at any moment if something changes.

The audit trail itself is your strongest compliance tool. It proves that your team followed process — photos were taken, incidents were reviewed on time, maintenance was performed on schedule.

Recommendations

• Issue audit tokens with the shortest reasonable duration. A 7-day window is usually enough for an insurance review; use 30 days for longer regulatory audits. Never issue 90-day tokens unless contractually required.
• Prepare for audits proactively: run a self-audit once per quarter. Issue yourself a token, open the auditor view, and scan for gaps — missing photos, incidents stuck in NEW for weeks, expired documents that were never replaced.
• Keep a log of who received tokens and when. The audit center shows this, but exporting a record before token expiry gives you a permanent paper trail.
• Revoke tokens immediately after the audit concludes. There's no benefit to leaving access open, and every open token is a (small) surface area for unauthorized access.