Source of Truth Document
Last Updated: January 2026
Classification: Public (Consumer + Technical Audience)
Piston Labs takes a fundamentally different approach to vehicle telematics: we minimize data collection by design. While competitors store everything and promise to protect it, we recognize that the most secure data is data that doesn't exist.
Our core principle: Can't steal what doesn't exist.
The vehicle telematics industry has a systemic security problem. Companies collect massive amounts of sensitive location data, store it indefinitely, and routinely fail to protect it.
| Company | Year | Records Exposed | Data Type | Root Cause |
|---|---|---|---|---|
| Spireon | 2023 | 15.5 million vehicles | Real-time GPS, VINs, user data | Exposed admin portal, hardcoded credentials |
| Gravy Analytics | 2025 | Billions of location points | Historical location data from 30+ apps | Data broker aggregation vulnerability |
| Tracelo | 2024 | 1.4 million users | Phone tracking, location history | Database misconfiguration |
| Hapn GPS | 2024 | 8,600 devices | Live tracker locations, owner info | No authentication on API |
| SiriusXM | 2022 | Unknown | Vehicle locations, commands | API authorization flaw |
Academic security research on consumer OBD-II dongles reveals systemic issues:
Source: Argus Cyber Security, University of Michigan Transportation Research Institute
Location data isn't just privacy-sensitive—it's dangerous:
When a telematics company is breached, every user's historical movements become public.
┌─────────────────────────────────────────────────────────────────┐
│ PISTON LABS DATA FLOW │
├─────────────────────────────────────────────────────────────────┤
│ │
│ [Otto Device] ──TCP──> [Cloudflare Worker] ──> [Durable Object]│
│ │ │ │
│ │ │ │
│ ┌─────────┴─────────┐ │ │
│ │ │ │ │
│ ▼ ▼ ▼ │
│ [GPS: WebSocket] [Non-GPS: Supabase] [State] │
│ (Ephemeral) (Persisted) (Temp) │
│ │ │ │
│ │ │ │
│ ▼ ▼ │
│ [User's App] [Service Records] │
│ (Real-time) [Mileage History] │
│ [Trip Summaries] │
│ │
│ ───────────────────────────────────────────────────────────── │
│ GPS flows through the system but is NOT stored by default. │
│ Users must explicitly opt-in to location history storage. │
└─────────────────────────────────────────────────────────────────┘| Data Type | Stored? | Justification |
|---|---|---|
| Current Odometer | Yes | Required for service reminders |
| Trip Distance | Yes | Fuel/efficiency calculations |
| Engine Diagnostics (DTCs) | Yes | Core product value |
| Battery/Voltage | Yes | Vehicle health monitoring |
| GPS Coordinates | No | Not needed for core functionality |
| Location History | No | Opt-in only |
| Movement Patterns | No | Never stored |
For users who want "Find My Car" functionality, we provide real-time location via WebSocket:
// Cloudflare Durable Object - GPS never touches disk
export class VehicleState extends DurableObject {
private sessions: Map<WebSocketSession, string> = new Map();
async processGPS(latitude: number, longitude: number) {
// Stream to connected clients
for (const [session] of this.sessions) {
session.send(JSON.stringify({
type: 'location',
lat: latitude,
lng: longitude,
timestamp: Date.now()
}));
}
// GPS is NOT written to storage
// When WebSocket closes, data is gone
}
}Security Properties:
Users who explicitly want location history can enable it:
// Only if user has opted in
if (user.locationHistoryEnabled) {
await supabase.from('location_history').insert({
vehicle_id: vehicleId,
latitude: coords.lat,
longitude: coords.lng,
recorded_at: new Date()
});
}Opt-In Requirements:
Our devices use Teltonika Codec 8 Extended binary protocol. GPS data sits at fixed byte offsets:
AVL Record Structure (per record):
┌──────────────────────────────────────────────────────────────┐
│ Timestamp │ Priority │ Longitude │ Latitude │ Alt │ ... │ IO │
│ 8 bytes │ 1 byte │ 4 bytes │ 4 bytes │ 2B │ │ │
│ │ │ ◄─────── GPS Block (15 bytes) ──────►│
└──────────────────────────────────────────────────────────────┘We can zero out GPS fields while preserving all diagnostic data:
function stripGPSFromCodec8(buffer: ArrayBuffer): ArrayBuffer {
const view = new DataView(buffer);
let offset = 10; // Skip preamble + length + codec + count
const recordCount = view.getUint8(9);
for (let i = 0; i < recordCount; i++) {
offset += 8; // Skip timestamp
offset += 1; // Skip priority
// Zero out GPS block (15 bytes)
for (let j = 0; j < 15; j++) {
view.setUint8(offset + j, 0);
}
offset += 15;
// Skip IO elements (variable length)
offset += parseIOLength(view, offset);
}
return buffer;
}Result: Raw binary archives for debugging contain zero location data.
| Attack Vector | Traditional Telematics | Piston Labs |
|---|---|---|
| Database breach | All historical GPS exposed | No GPS to expose |
| Backup theft | Location history in backups | No location in backups |
| Insider threat | Employee access to all data | GPS never reaches backend |
| SQL injection | Query returns GPS history | GPS field doesn't exist |
| API abuse | Enumerate user locations | No location endpoint |
| Legal subpoena | Must provide all stored data | No GPS data to provide |
| Data broker sale | Monetize location data | Nothing to sell |
Using standard risk calculation: Risk = Probability × Impact
Traditional Approach:
Piston Labs Approach:
Risk Reduction: 80%
Traditional Approach:
Piston Labs Approach:
If Piston Labs is breached, attackers could access:
| Data | Sensitivity | Mitigation |
|---|---|---|
| Email addresses | Medium | Industry standard |
| Vehicle VIN | Low | Already semi-public |
| Odometer readings | Low | No privacy impact |
| Service history | Low | No location correlation |
| Diagnostic codes | Low | Technical data only |
Notably absent: Location history, movement patterns, home/work addresses, daily routines.
| Regulation | Requirement | Our Compliance |
|---|---|---|
| GDPR | Data minimization | Collect only what's necessary |
| CCPA | Right to deletion | No GPS to delete (by default) |
| CPRA | Limit sensitive data | GPS is opt-in only |
| State privacy laws | Reasonable security | Reduced attack surface |
When law enforcement requests location data:
Traditional Company Response:
"Here are 18 months of GPS coordinates for this vehicle..."
Piston Labs Response:
"We do not store location data. Real-time GPS is ephemeral and not logged."
We cannot provide what we don't have. This isn't obstruction—it's architecture.
Our architecture provides liability protection:
Wrong approach (competitor-style):
"We take your privacy seriously. Your data is encrypted and protected by enterprise-grade security."
Our approach:
"We don't store your location. Period. Your car's GPS flows through our system to your phone, but we don't keep it. Can't leak what we don't have."
Q: How do you provide real-time location without storing it?
A: We use WebSocket streaming through Cloudflare's edge network. When you open the app, your car's GPS coordinates flow directly to your phone. When you close the app, the connection ends and the data is gone. It's like a phone call—the conversation happens, but we're not recording it.
Q: What if I want location history?
A: You can opt in. We'll store up to 90 days of location data, and you can delete it anytime. But we think most people don't actually need a permanent record of everywhere their car has been.
Q: What do you actually store?
A: Odometer readings, engine diagnostic codes, battery voltage, fuel efficiency data. The stuff that helps you maintain your car, not track your movements.
Q: What happens if you get hacked?
A: Attackers would get diagnostic data—the same information your mechanic sees. They wouldn't get location history because we don't have it.
These rules must never be violated:
| Feature | Bouncie | Zubie | Hum | Piston Labs |
|---|---|---|---|---|
| GPS tracking | Always on | Always on | Always on | Opt-in only |
| Location history | Stored indefinitely | 1 year | Stored | Not stored (default) |
| Data monetization | Yes (anonymized) | Yes | Yes | Never |
| Breach exposure | Full history | Full history | Full history | Diagnostics only |
| Monthly cost | $8/mo | $10/mo | $10/mo | TBD |
Privacy-first isn't a feature—it's an architectural decision that's hard to reverse. Competitors would need to:
By the time they catch up, we'll have the privacy-conscious market.
What happened: Security researcher found exposed admin portal with hardcoded credentials. Could access 15.5 million vehicles across multiple fleet management brands (GoldStar, LoJack, FleetLocate).
Data exposed: Real-time GPS, historical locations, VINs, customer data, ability to remotely disable vehicles.
Root cause: Credential management failure, no authentication on admin API.
Piston Labs difference: Even with similar vulnerability, attacker gets diagnostic data only.
What happened: Location data broker (aggregates from 30+ apps) suffered massive breach. Billions of location data points exposed including sensitive locations (clinics, government buildings, religious sites).
Impact: Location data traced back to individual devices, revealing daily patterns and sensitive visits.
Root cause: Centralized aggregation of location data creates high-value target.
Piston Labs difference: We don't aggregate or sell data. No data broker relationship.
What happened: API vulnerability allowed attackers to locate vehicles, unlock doors, start engines using only VIN number.
Root cause: Authorization bypass—API didn't verify requestor owned the vehicle.
Piston Labs difference: Our WebSocket requires authenticated session. No remote commands.
[Device] ──TLS/TCP──> [Cloudflare Edge] ──Internal──> [Durable Object]
│
│ (GPS)
▼
[WebSocket]
│
▼
[User's Device]
GPS never touches: Database, Logs, Backups, Analytics| Layer | Method | Key Management |
|---|---|---|
| Device → Edge | TLS 1.3 | Cloudflare managed |
| Edge → DO | Internal (Cloudflare backbone) | N/A |
| DO → User | WSS (TLS) | Cloudflare managed |
| Database | AES-256 at rest | Supabase managed |
| Role | GPS Access | Diagnostic Access |
|---|---|---|
| End User | Real-time (own vehicle) | Yes |
| Support Staff | None | Read-only |
| Engineering | None | Anonymized |
| Database Admin | None (doesn't exist) | Encrypted |
| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | Jan 2026 | Engineering | Initial document |
Review Schedule: Quarterly or after any security incident
Owner: Engineering Team
Approval: Tyler (CEO)