Fleet software vendor security questionnaire
Send the same questions to every supplier and ask for documents in the scope you intend to buy. Keep assertions, documents, certification coverage and test results separate, then prioritize open questions by your own data sensitivity.
Where ReWheel stands
ReWheel can offer a deployment in a Canadian region, and in other countries' regions on request; storage, processing and access locations and subprocessors are confirmed in a reviewed deployment proposal.
Define the scope of the answers
Identify the application, service, region, data categories and contract scope before reviewing an answer. Cyber Centre acquisition guidance treats documentation and evaluation as distinct activities. Use that distinction to ask what the supplier states, what documents support it and what authorized testing actually covered. A completed questionnaire is neither certification nor legal assurance.
Location records can be sensitive in a workplace context. The OPC guidance distinguishes applicable federal and provincial contexts. Your responsible privacy reviewer should determine the applicable requirements; this questionnaire does not declare every fleet subject to the same regime.
Review seven concrete topics
Use the table to request access, encryption, recovery, incident, subprocessor, logging and deletion proof. An unanswered cell stays unanswered. Do not infer an encryption design, successful restore, penetration test or certification from a general marketing statement.
If the service has AI features, add one question: is your fleet data used to train or improve AI models, which services receive it for AI processing, and how do you opt out? Ask for the answer in writing.
Prioritize and resolve rather than average away gaps
Review procedure
- Set your sensitivity and priority ratings before comparing responses; identify mandatory requirements separately.
- Record the exact service/version, region and date covered by each document or test.
- For any certificate or report offered, verify its entity, scope, period and relevant exclusions.
- If proof is unavailable, record the limitation and an accountable follow-up decision.
- Do not replace a missing mandatory answer with a numerical average or an assumed pass.
- Have the appropriate buyer reviewer accept or reject unresolved conditions before relying on the service.
Tying security answers to confirmed data locations
A security answer is only as useful as the scope it covers.
Ask for
- The storage, processing and access locations each security statement applies to.
- Which subprocessors are involved and where they operate.
- The date and scope of the proof behind each statement.
Seven-area security questionnaire
Answer fields are left blank. Nothing is prefilled.
On a small screen, scroll this table horizontally. Keyboard users can focus the table region and use arrow keys.
| Area | Question | Requested proof |
|---|---|---|
| Access control | Which roles, scopes, authentication and revocation procedures apply? | Role design, access procedure and authorized denied-action test |
| Encryption | Which links and copies are covered, and who controls keys? | Scoped architecture and key-management documentation |
| Backups | Which records are recoverable and how is restoration verified? | Recovery scope, retention terms and dated restore-test proof |
| Incident response | Who notifies whom and what are the agreed triggers and timing? | Incident procedure, responsibility contacts and exercise scope |
| Subprocessors | Which services handle each data category and what changes require notice? | Current subprocessor list, purposes and contractual change procedure |
| Logging | Which access and change events are recorded and who reviews them? | Event catalogue, authorized sample and review/retention procedure |
| Deletion | Which copies are covered and what exclusions or delayed removals apply? | Deletion procedure, backup/hold scope and completion proof |
Sources and review context
What ReWheel provides
ReWheel FMS connects supported vehicle information with equipment and operational records for field and institutional operations. Vehicle compatibility, data-access requirements, connectivity and installation are assessed per deployment, never assumed.
Continue with ReWheel: Operational fleet records for Canadian buyers
Discuss your workflow