Security
Security and your data
Transit Planner holds your GTFS feeds, scenarios, stop surveys and reports. This page explains where that data lives, who can see it, and how we protect it.
Your data is yours
Your agency owns its data. Export feeds, scenarios and reports at any time as GTFS, PDF, Word or JSON. We don’t sell or share agency data. To delete your workspace’s data, email us.
Separate workspaces
Each agency works in its own workspace. Every request is scoped to your agency in the application, and automated tests check that one agency can’t read or change another’s data.
Sign-in and roles
People sign in with a one-time code sent to their email, so there are no passwords to steal or reuse. Agency admins invite users and give each one a role: agency admin, planner, or viewer. Viewers can look but can’t change anything, and the server checks the role on every change.
Encryption
All connections use HTTPS. Data at rest is encrypted with AES-256 by our database provider, Neon, and our file storage, Vercel Blob. Uploaded feeds and stop photos are kept in private storage that requires authentication.
Where your data lives
The application runs on Vercel and the database on Neon, both in the United States. The travel-time engine behind transit reach and job access runs on a dedicated server in Germany, hosted by Hetzner. It works from published GTFS schedules, OpenStreetMap streets and the map points you query, and it receives no personal information.
Monitoring and recovery
We track application errors, run automated health checks, and review a daily operations report. Our database provider keeps a point-in-time history, so data can be restored to an earlier moment.
Service providers
| Provider | What it does |
|---|---|
| Vercel | Hosts the application and stores uploaded files |
| Neon | Hosts the database |
| Clerk | Handles sign-in |
| Cloudflare | Network and DNS in front of the application |
| Hetzner | Runs the travel-time engine (Germany) |
| Mapbox | Serves the map tiles |
| Resend | Sends notification emails |
| Sentry | Error monitoring |
Certifications
We don’t hold SOC 2 or a similar certification yet. Send us your agency’s security questionnaire and we’ll complete it.
Report a security issue
Email info@lmailabs.ai. We acknowledge reports within two business days.
See it on your network in 15 minutes
We load your GTFS and walk through one real service change with you: the cost, who it affects, and the report. No sales script.