Security at Mansa
Fleets trust Mansa with pay, loads, driver records and documents. This page says, in plain language, what protects that data today, and separately what will arrive with Mansa's own server, which is not live yet. Updated 2 November 2026.
Where Mansa runs today
Mansa Drive and Mansa Invoices are in early access. During early access they run inside Claude, Anthropic's platform: people sign in with their Claude account, and records are stored by Anthropic, which is listed on our Subprocessors page. The mansafleet.com website is a static site served by Cloudflare; it has no sign-in, sets no cookies of its own and runs no analytics.
In place today
- Encrypted connections. The website is served only over HTTPS, with HSTS so browsers refuse plain HTTP, through Cloudflare. The apps are reached over HTTPS through Claude.
- Only part of a number is kept. For fuel cards, Mansa keeps the last 6 characters. For driver ID numbers such as a CDL, SSN or national ID, it keeps the last 4.
- Device checks are stored as hashes. The one-time device check for free-trial eligibility stores scrambled (hashed) signals only, never the raw values.
- Optional company encryption in Mansa Invoices. A company can encrypt its records with its own passphrase (AES-256-GCM, with the key derived using PBKDF2-SHA256). Mansa cannot read those records without it.
- End-to-end encrypted password vault in Mansa Drive. Vault entries are encrypted in the browser before they are saved; only ciphertext and encrypted keys are stored.
- App lock. A PIN or password can lock the app on a shared device. It is stored only as a salted hash.
- No payment secrets in the apps. Online payments are not open yet, and no payment-gateway keys or M-Pesa (Daraja) credentials are kept in the apps or their data.
Not in place yet
Each company's records are not yet kept apart by a database of Mansa's own. Today, access to a company's records follows who the owner has given access to the app in Claude. Separate storage for every company arrives with the Mansa server.
Arriving with the Mansa server (not live yet)
- Cloudflare in front of the app, and an origin that answers only Cloudflare, with TLS checked in full between them.
- A second firewall on the server (ModSecurity with the OWASP Core Rule Set) and rate limits per address, user, company and session.
- Each company's data kept apart by row-level security on every table, checked against the company and the signed-in user on every request.
- Payment secrets in a separate secret store, never in the app, the database or the logs.
- Upload scanning for malware before files are stored and served.
- Every change reviewed, with an automated security review that blocks changes with unresolved problems in sign-in, payments or data deletion.
- A public status page for outages.
This page will move each item to "In place today" only when it is live.
AI that reads your documents
When you import a PDF, a photo or a screenshot, Mansa sends it to Anthropic's Claude to read the rows. What it reads is shown to you in a preview, and nothing is saved until you confirm it. Anthropic acts as Mansa's processor for this. Any other AI provider will be named here and in the Privacy Policy before it is used.
Latest security audit
No independent audit or penetration test has been completed yet. One will be done before the Mansa server goes live, and its scorecard, what was tested, what was found and what was fixed will be published here.
Report a security problem
If you think you have found a weakness in Mansa, email support@mansafleet.com with "Security report" in the subject. Include what you found and the steps to reproduce it. Please don't access or change other people's data, and give us time to fix the problem before you share it. Our contact details are also in security.txt.