Trust Center

SOC 2 Type II sets the requirements for effective internal controls across the Trust Principles of Security, Availability, Processing Integrity, Confidentiality, and Privacy. Amber Innovations, which operates Amber OnTime, has been independently examined against all five, with controls tested for both suitability of design and operating effectiveness across the period 1 February 2026 to 31 July 2026.

The examination covered the Amber Innovations Processing System, with Amber OnTime named as an in-scope platform. It spans production and supporting non-production environments, the underlying cloud infrastructure, core application and service delivery components, and the systems used to store and process ride and customer data, along with platform operations, incident management, change management, access management, and backup and recovery.

Systems are protected against unauthorised access, disclosure, and damage through role based access control, enforced multi-factor authentication, hardened managed devices, and continuous monitoring.

Infrastructure is designed for resilience with multi-region redundancy, uptime monitoring with automated alerting, automated backups, and a business continuity plan with defined recovery objectives.

Ride records, trip tracking, and fare calculations are processed completely, accurately, and on time. Syntactic and semantic validation, manual spot checks, and reconciliation across system interfaces underpin all processing commitments.

Rider and Captain information is protected with encryption at rest and in transit, need-to-know access subject to periodic review, data loss prevention, and confidentiality agreements binding every employee and contractor.

Ride history, location, and personal data are collected, used, retained, and disposed of per our published privacy policy, the GDPR, and Jamaica's Data Protection Act, with documented procedures for the rights to access, rectify, restrict processing, and request erasure.

Access is granted on a least-privilege basis, tied to job role and business need, with role based access control and multi-factor authentication enforced across systems and accounts. Access is provisioned on joining, reviewed on a regular cycle, and revoked promptly on departure or role change.

Employee devices are centrally managed and hardened, with endpoint detection and response, data loss prevention, mandatory full-disk encryption, removable media blocking, and web filtering. Perimeter traffic is filtered and inspected, and remote access requires an encrypted VPN with MFA.

A risk-based programme identifies, assesses, and remediates weaknesses across infrastructure and applications. Findings come from regular internal scanning and annual third-party penetration tests, and are prioritised by severity and tracked to closure.

Security events across endpoints, network devices, and cloud systems are aggregated and reviewed centrally through a SIEM platform, supported by intrusion detection and prevention and continuous uptime monitoring. Our incident response process covers triage, communication, remediation, and root cause analysis.

A documented Secure Software Development Methodology governs design, coding, testing, and deployment. Changes pass through a controlled CI/CD pipeline with peer code review, staging tests, version control, strict approval and audit mechanisms, and documented rollback procedures.

A formal business continuity and disaster recovery plan defines recovery time and recovery point objectives. Critical data is backed up automatically across redundant multi-region infrastructure with encryption enforced, alerting on failure, and regular restoration testing.

A documented risk assessment and treatment plan covers data security, regulatory obligations, vendor dependencies, and technology risks, with defined operational priorities. Senior management incorporates the results into decision-making and resourcing.

Service providers and subservice organisations are monitored through contractual arrangements, periodic reviews, and oversight activities. Independent assurance reports from our cloud provider are reviewed annually.

Data, personnel, devices, systems, and facilities are managed under a documented asset management policy, with handling and access controls applied by sensitivity. Data is retained only as long as contractual or regulatory obligations require, then securely disposed of.

Encryption standards are applied across the data lifecycle under a formal cryptography policy. Cloud storage and managed databases are encrypted, endpoints and servers use full-disk encryption, and data in transit is secured with modern TLS. Keys are managed under policy.

The in-scope system is hosted by Amazon Web Services in the United States, using multi-region deployments for high availability. AWS is responsible for physical and environmental security of the data centres hosting our production infrastructure. We review their SOC 2 Type II and ISO 27001 reports annually.

Kuya Technologies supports software design, development, testing, maintenance, and technical operations under Amber Innovations' policies, standards, and oversight. Amber Innovations retains ownership, governance, and accountability for the security and privacy of the service.

Manage your application accounts and available security settings, safeguard user IDs and passwords, review access rights periodically, and revoke access promptly for terminated or reassigned personnel.

Define acceptable data types for entry into the Amber OnTime system in line with your classification and privacy requirements, transmit over secure or encrypted channels, and safeguard system-generated trip reports and outputs.

Notify Amber OnTime promptly if you discover or suspect an incident involving our services, and act on our communications about platform changes that may affect security or availability.

Deploy endpoint protection on all devices used to access Amber OnTime's corporate services, and maintain independent business continuity and disaster recovery plans for your own environments.