Public Policy Skeleton

Data Protection Policy

This policy describes DMV Protect security expectations for protecting public, driver, lawyer, payment, document, and assistant-related data.

Last updated: May 18, 2026

Security Principles

DMV Protect should protect data using least-privilege access, secure authentication, protected secrets, encrypted transport, secure service records, and role-based access boundaries.
Sensitive credentials, API keys, Turnstile secret keys, email service credentials, database credentials, and payment service secrets must never be exposed in frontend code or public repositories.
Security controls should be reviewed as new driver, lawyer, payment, upload, voice, and assistant features are added.

Drivers should access only their own account, subscription, ticket/citation claims, documents, case timeline, cancellation, member benefit, and reactivation workflows.
Paid lawyers should access only approved paid-lawyer profile and subscription workflows unless separately authorized for a specific DMV Protect case workflow.
Assigned lawyers should access only the matters assigned to them and the related case-update or notice-response workflows.
DMV Protect review-team access should be limited to authorized service, support, compliance, and account-review purposes.

Alex public chat requests must generate a fresh Cloudflare Turnstile token for each backend message interaction that calls the chat endpoint.
The backend must verify Turnstile tokens before passing any public message to Alex or other model processing.
Turnstile tokens must not be logged, stored, reused, or treated as a replacement for authentication, authorization, or role checks.

Ticket/citation documents, driver license documents, court records, and other private files should be uploaded only through approved secure account workflows.
File storage should use access controls, file-level permission checks, abuse review where appropriate, and secure records for upload, view, update, and deletion activity.
Public pages should not request private claim documents before secure authenticated workflows are available.

Important account, claim, payment, member benefit, reactivation, identity-match, lawyer-assignment, notice, assistant, Guided Help, and review-team actions should be recorded securely.
Security failures such as invalid Turnstile checks, unauthorized access attempts, suspicious submissions, and blocked Guided Help actions should be monitored.
Security records should be protected from unauthorized editing or deletion and retained according to DMV Protect policy and legal requirements.

Suspected data incidents should trigger review, containment, remediation, and documentation.
Where required, DMV Protect should notify affected users, service providers, regulators, or other parties according to applicable law and policy.
Security lessons learned should be used to update controls, training, monitoring, and product safeguards.