BusCommand Technical Report & Security Audit

1. Executive Summary

BusCommand is a specialized Software-as-a-Service (SaaS) platform designed exclusively for public transit operators. The platform provides dispatcher operations management, driver shift scheduling, and real-time fleet coordination with enterprise-grade security, multi-tenant isolation, and full compliance with European data protection regulations.

2. System Architecture & Data Residency

2.1 Cloud Infrastructure

BusCommand operates exclusively on Google Cloud Platform (GCP) infrastructure hosted in the Frankfurt, Germany region (europe-west3). This ensures:

• EU Data Residency: All customer data remains within the European Union
• GDPR Compliance: Full alignment with EU data protection requirements
• Low Latency: Optimized for European transit operators
• High Availability: GCP's regional redundancy and disaster recovery capabilities

2.2 Technology Stack

Layer	Technology	Purpose
Frontend	Vanilla JavaScript + Tailwind CSS	Lightweight, fast-loading user interfaces
Backend	Node.js + Express	RESTful API server with middleware for authentication and authorization
Database	Google Cloud Firestore (europe-west3)	NoSQL document database with real-time synchronization
Authentication	Custom PIN-based system with bcrypt hashing	Zero-credential architecture without password storage
Hosting	Google Cloud Platform (europe-west3)	EU-resident cloud infrastructure

2.3 High Availability & SLA

2.4 Offline-First PWA Capabilities

The Driver application is built as a Progressive Web App (PWA) with offline-first architecture:

• Service Worker Caching: Critical application assets cached locally
• Offline Operation: Drivers can view assigned shifts and confirm receipt without active internet connection
• Background Sync: Actions sync automatically when connectivity is restored
• Installable: Can be installed on mobile devices without app store distribution

3. Multi-Tenant Isolation Architecture

3.1 Logical Separation

Each transit operator (tenant) operates in a completely isolated logical environment:

• Tenant ID Scoping: All database queries include mandatory tenant ID filtering
• Zero Cross-Tenant Leakage: Tenants cannot discover the existence of other tenants
• Separate Authentication Contexts: User sessions are strictly tenant-scoped

3.2 Database Isolation

3.3 Application-Level Isolation

• Role-Based Access Control (RBAC): Users can only access data within their assigned groups and roles
• Group-Level Scoping: Dispatchers see only routes and drivers assigned to their specific groups
• Audit Trail: All cross-tenant access attempts are logged and monitored

4. D21 Zero-Credential & Zero-Knowledge Architecture

4.1 Zero-Credential Policy

BusCommand implements a zero-credential architecture that eliminates traditional password-based authentication risks:

• No Password Storage: User passwords are never stored or transmitted
• PIN-Based Authentication: Drivers and dispatchers use short PIN codes for access
• Bcrypt Hashing: All PINs are hashed using bcrypt with appropriate work factors
• No Credential Recovery: PINs cannot be recovered, only reset by authorized administrators

4.2 Zero-Knowledge Principles

4.3 Role-Based Access Control

Role	Permissions	Data Access Scope
Super Admin	Platform configuration, tenant management	Platform-level (non-customer data)
Company Admin (CA)	Group management, dispatcher assignment, duty catalog	Entire tenant organization
Dispatcher (Dispo)	Monthly plan import, shift management, fleet swaps	Assigned groups only
Driver	View shifts, confirm receipt, report incidents	Personal assignments only

4.4 Credential Boundary Protection

• No PIN Exposure in Logs: PINs never appear in application logs, error messages, or debugging output
• No PIN Exposure in UI: PIN input fields are masked and never displayed in plain text
• No PIN Exposure in API: PINs are never transmitted in API responses or included in error payloads

5. Deterministic Plan-Lock Dispatching & Fleet Operations

5.1 Plan-Lock Mechanism

The Plan-Lock feature ensures operational consistency and prevents conflicting modifications:

• Published Plan State: Once a monthly plan is published, it becomes the immutable source of truth
• Revision Control: All modifications create new revisions with full audit trail
• Conflict Detection: Concurrent modifications are detected and resolved with server-side authority

5.2 Sub-3 Second Fleet Swaps

5.3 Server-Side Authority

• Client Not Trusted: All authorization, availability, and conflict resolution decisions are made server-side
• No Optimistic UI Locking: The UI never claims success without server confirmation
• Real-time Synchronization: Changes are propagated to all connected clients via Firestore real-time updates

6. 24-Month Immutable Append-Only Audit Logging

6.1 Audit Log Architecture

BusCommand maintains comprehensive, immutable audit logs for all system operations:

• Append-Only Design: Audit log entries can never be modified or deleted
• 24-Month Retention: All audit records are retained for minimum 24 months
• Comprehensive Coverage: All data mutations, access attempts, and configuration changes are logged

6.2 Logged Events

Event Category	Examples
Authentication	Login attempts, PIN changes, role assignments
Plan Management	Plan imports, publications, modifications, fleet swaps
Driver Operations	Shift confirmations, incident reports, status changes
Configuration	Group changes, dispatcher assignments, duty catalog updates
Security	Authorization failures, cross-tenant access attempts, policy violations

6.3 Audit Log Integrity

7. Data Protection & GDPR Compliance

7.1 GDPR Alignment

BusCommand is designed to comply with GDPR requirements:

• Lawful Basis: Processing is based on legitimate interests for transit operations and contractual necessity
• Data Minimization: Only data necessary for operations is collected and processed
• Purpose Limitation: Data is used only for stated transit management purposes
• Storage Limitation: Data is retained only for necessary operational periods

7.2 Data Subject Rights

• Right to Access: Users can request copies of their personal data
• Right to Rectification: Inaccurate data can be corrected
• Right to Erasure: Data can be deleted when no longer required for operations
• Right to Portability: Data can be exported in standard formats

7.3 Article 88 (Right to Disconnect) Compliance

7.4 EU 561/2006 Driving-Time Awareness

The platform assists dispatchers in tracking driver working hours relevant to EU Regulation 561/2006:

• Shift Tracking: Accurate recording of shift start/end times
• Rest Period Alerts: The dispatcher cockpit flags consecutive-day duties with less than 11 hours between shift end and next shift start (Art. 8 daily rest floor), for dispatcher review — this is an informational aid, not an automated legal determination
• Audit Trail: Every shift change is recorded in the append-only audit log for later review

Final responsibility for driving-time and rest-period compliance remains with the operator and its transport-law counsel. BusCommand does not replace a certified tachograph/working-time compliance system.

8. Technical & Organizational Measures (TOMs)

8.1 Encryption

Data State	Encryption Method	Implementation
In Transit	TLS 1.3	All connections use HTTPS with TLS 1.3 or higher
At Rest	AES-256	Firestore automatically encrypts data at rest using AES-256
In Memory	Application-level isolation	Process isolation and memory protection

8.2 Access Controls

• Least Privilege: Users have minimum necessary permissions for their roles
• Multi-Factor Authentication: Optional MFA for administrative accounts
• Session Management: Secure session handling with appropriate timeout policies
• IP Restrictions: Optional IP-based access restrictions for sensitive operations

8.3 Organizational Measures

• Staff Training: Regular security and data protection training for all personnel
• Background Checks: Verification of personnel with access to production systems
• Incident Response: Established procedures for security incident handling
• Contractual Controls: Data processing agreements with all subprocessors

9. Subprocessor Disclosure

9.1 Primary Subprocessor

9.2 Subprocessor Terms

• EU Data Residency: All GCP services are configured for europe-west3 region
• Data Processing Agreement: Contractual agreement with Google ensuring GDPR compliance
• No Cross-Region Transfer: Data is not transferred outside the EU without explicit customer consent

10. Security Monitoring & Incident Response

10.1 Continuous Monitoring

• Infrastructure Monitoring: 24/7 monitoring of cloud infrastructure and application performance
• Security Event Logging: Centralized logging of security-relevant events
• Anomaly Detection: Automated detection of unusual access patterns or behavior

10.2 Incident Response Procedures

10.3 Vulnerability Management

• Regular Updates: Dependencies are regularly updated for security patches
• Security Audits: Regular security audits and penetration testing
• Bounty Program: Responsible disclosure program for security researchers

11. Backup & Disaster Recovery

11.1 Backup Strategy

• Automated Backups: Daily automated backups of all customer data
• Geographic Redundancy: Backups stored in separate EU regions for disaster recovery
• Point-in-Time Recovery: Ability to restore data to specific points in time (PITR)

11.2 Recovery Objectives

Metric	Target
RPO (Recovery Point Objective)	≤ 1 hour
RTO (Recovery Time Objective)	≤ 4 hours

12. Conclusion

BusCommand provides enterprise transit operators with a secure, compliant, and operationally efficient platform for managing fleet operations. The architecture prioritizes data protection, multi-tenant isolation, and operational reliability while maintaining the flexibility required for dynamic transit operations.