Security

Effective: August 29, 2026

WeRoll is built on modern cloud infrastructure and operated with established security practices to protect user accounts, location visibility, and real-time communications. This page describes the protections you can expect. Detailed technical documentation is available to customers and partners under review.

Security Controls

Identity & access — Access to your account and data requires authentication, and authenticated requests are authorized against what that account is permitted to do.
Least privilege — Users and internal services are granted only the access required for their function.
Data protection — Data is protected in transit and at rest using current industry-standard encryption.
Boundaries between accounts — Controls are designed to keep each account’s data separated and to prevent unintended cross-account access.
Push notification privacy — Push delivery uses opaque tokens rather than user-identifying endpoints.
Non-public internal systems — Backend data stores are access-controlled and not directly reachable from the public internet.

Monitoring & Abuse Prevention

Rate limiting — Broadcast, follow, and notification endpoints are rate limited to prevent abuse.
Abuse detection — Automated checks flag patterns such as excessive follow activity, rapid account creation, and implausible location movement for review.
Operational monitoring — Key paths are continuously monitored, and failures alert the operations team.
Auditability — Security-relevant activity, including privileged administrative actions, account deletions, and vendor profile changes, is recorded so it can be traced where appropriate.

Your Location Visibility

Going live is always time-limited. Broadcast sessions end automatically after a maximum duration, and a session also ends on its own if location updates stop, so a stale location does not keep showing you as live. You can end a session yourself at any time.

Responsible Disclosure

If you believe you have discovered a security vulnerability in WeRoll, please report it to security@bustersense.com. We respond within 3 business days and credit good-faith researchers in our public acknowledgements.

We ask that you:

Avoid actions that degrade service for other users (DoS, mass data extraction).
Avoid accessing data that is not yours; use a test account.
Give us reasonable time to fix issues before public disclosure.

Incident Response

If a security incident affects user data or service availability, we will notify affected users via email and post a status update at /transparency. For active investigations, we may delay specific technical details until remediation is complete.