Vehicle records: a practical access and sharing review

Vehicle work can produce photographs, condition observations, signatures and contact details as well as vehicle identifiers. A useful software review asks what is recorded, who needs it and how it reaches them. This guide is an operational checklist for that conversation, not legal advice or a claim that using the software makes an organisation POPIA-compliant.

List the records and their purpose

Take one receiving or handover process and list the information captured at each step. Include photographs and attachments, not just the visible form fields. Ask the operations and compliance reviewers which information is necessary for the task and which should not be collected in the first place.

• Vehicle identity and the relevant consignment or operation.
• Inspection observations, photographs and any recorded signatures.
• Names or contact details needed for the agreed workflow.
• Reports or files sent to another team or organisation.

Test access as different users

The Stevedoring App uses organisation-scoped access and configured permissions. During an evaluation, ask to see the intended operator and reviewer views. Do not treat a common VIN as permission to see records held by every company that handles that vehicle.

Record who owns access decisions and how a person's access is reviewed when their role changes. A general demonstration of an administrator account is not enough to establish what a field worker or external recipient can see.

Review the external handover

A PDF attachment and a controlled online view have different lifecycles. Ask which information is exposed by the sharing method you intend to use, who can open it and how expiry or revocation applies where supported. Do not assume that withdrawing a link can retrieve a copy somebody has already downloaded.

1. Prepare an anonymised record with the fields and attachments you expect to share.
2. Inspect the recipient's view, not only the sender's screen.
3. Confirm that unrelated records and fields are not included.
4. Test the applicable expiry or revocation behaviour.
5. Agree how your team records and handles an incorrect recipient or sharing mistake.

Separate product controls from contractual answers

Ask for current answers to your retention, export, incident-response, hosting and procurement requirements. Treat those as matters to verify with the responsible team, not features inferred from a security label. This guide does not promise a particular data location, certification, deletion deadline or response-time commitment.

For a POPIA review, use the Information Regulator's official materials with your organisation's legal or compliance advisers. Keep the agreed requirements and the evidence used to assess them together. A software checklist cannot decide the legal obligations of every operator, customer or recipient.

Bring questions, not sensitive records

A blank inspection template, a list of user roles and a description of the intended recipient are useful starting points. Use anonymised examples in a demo and avoid putting customer records, VIN lists, identity documents or sensitive attachments into the public enquiry form. The first conversation should establish scope and an appropriate way to assess the evidence.