DriverBoost ("DriverBoost") is committed to protecting the confidentiality, integrity and availability of the information you share with us. This page describes the security practices we follow and how you can help keep your information safe. It applies to the Site and to our internal systems that handle personal information.
1. Our approach
We apply a risk-based security program built around a few principles: collect only what we need, protect it while it moves and while it is stored, limit who can see it, choose vendors carefully, monitor for problems and act quickly when something goes wrong.
2. What we protect
The information we handle includes names, contact details, dates of birth, gig-work and earnings details, requested amounts, consent records, support messages and technical data. We classify this information by sensitivity and apply stronger controls to what would cause the most harm if exposed.
3. Encryption
- In transit: the Site is served over HTTPS using current TLS, so data you send is encrypted between your browser and our servers.
- At rest: data we store with our hosting and infrastructure providers is encrypted at rest where the provider supports it. [Confirm with your host.]
- Keys and secrets: credentials and keys are kept in managed secret storage and not in source code.
4. Access control
- We give people access only to the information they need for their role (least privilege).
- Administrative and production accounts require strong, unique passwords and multi-factor authentication where available.
- Access is reviewed periodically and removed promptly when someone changes roles or leaves.
- Important actions and access events are logged so they can be reviewed.
5. Your bank information
We never ask for your bank login or password on this Site or by email, phone or text. If a lender uses a secure bank-connection provider, you will see a separate window or page from that provider, and your credentials go to the provider, not to DriverBoost. Always check the address bar and the lender’s name before entering anything sensitive.
6. Vendors and partners
We use third parties for hosting, email and text messaging, analytics and fraud prevention. Before we use a provider that handles personal information, we consider its security practices and require contract terms on confidentiality, data use and breach notification. Lenders in our network are independent businesses responsible for the security of information they receive and collect.
7. Secure development and monitoring
- Code is version-controlled and reviewed before release.
- Dependencies are monitored and updated to address known vulnerabilities.
- We use rate limiting and bot protection to reduce abuse and automated attacks.
- Forms validate input to guard against common web attacks.
8. Incident response
We maintain a plan to detect, contain and investigate suspected security incidents. If an incident affects your personal information, we will assess the risk and notify affected people and regulators within the time required by law, and take steps to prevent a repeat.
9. Protect yourself from scams
Gig workers are often targeted by fake lenders and phishing messages. Be careful if someone:
- Asks for an upfront fee to “release” or “guarantee” your advance.
- Asks for your bank password, one-time code or full card number.
- Guarantees approval before reviewing your information.
- Pressures you to act immediately or keep the offer secret.
- Contacts you from a personal number or messaging app, or from a look-alike website address.
- Sends a link that does not go to a domain you recognise. Our official site is driverboost.co, and we only email from @driverboost.co addresses.
If you are unsure whether a message is from us, do not click links. Email support@driverboost.co to check.
10. How you can help
- Use a unique password and a password manager.
- Turn on multi-factor authentication for your email and bank.
- Keep your phone and browser updated.
- Avoid entering sensitive details on public Wi-Fi.
- Log out of shared devices and review your bank statements regularly.
11. Reporting a security concern
If you believe you have found a vulnerability, or suspect your information has been misused, email support@driverboost.co with the subject “Security”. Please give enough detail to reproduce the issue and do not access data that is not yours. We will acknowledge reports and investigate in good faith. We ask that you give us reasonable time to fix an issue before disclosing it publicly.
12. Laws and standards we follow
We aim to comply with the privacy and data-security laws that apply to our business, such as the Federal Trade Commission Act, state data-breach notification laws, and state consumer privacy laws like the California Consumer Privacy Act. Where the Gramm-Leach-Bliley Act’s Safeguards Rule applies to us, we maintain a written information security program. [Attorney to confirm which laws apply.] For how we use data, see our Privacy Policy.
13. Limits and updates
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We review this page at least once a year or when our practices change materially, and we update the dates above when we do.