Do small traffic control companies really need to worry about this?

The data is the same regardless of company size: customer contacts, rates, crew personal details, payment records and signed tickets. A shared password that leaves with a former employee is a more likely problem than a sophisticated attack, and it is one you can prevent.

What should happen when an employee leaves?

Their access should be removable in one step, the same day, without affecting anyone else. That requires every person to have their own login. Shared logins make it impossible.

Should I ask a vendor for a security certification?

Ask what independent assessments they have had and ask to see the report or a summary. A certification is evidence, not a guarantee, and a vendor without one should still be able to answer the questions in this post clearly and in writing.

Where does card payment data fit in?

Ask whether card numbers ever touch the vendor's own systems or go straight to a payment processor. Handing card handling to a processor is the common approach, and it keeps card data out of your dispatch system.

Traffic Control Software Security: Questions to Ask

Q: What is the most important security feature to ask about?

Multifactor authentication. CISA, the federal cybersecurity agency, says using it on your accounts makes you 99% less likely to be hacked. Ask whether the software supports it and whether you can require it for every user.

Dispatch software holds your customer list, your prices, your crew's personal details and every signed ticket. Here are the security questions a traffic control owner should ask any vendor, in plain language, with what a good answer sounds like and where to check it.

When you move from a whiteboard and spreadsheets to dispatch software, you put the whole business in one place. Customer contacts and their rates. Every quote you have sent. Crew names, phone numbers and hours. Signed tickets and photos. Possibly payment records.

That is the point of the software. It also means the security of that one place matters, and most traffic control owners are not sure what to ask about it.

This post is a list of questions in plain language. None of them need an IT background. For each one there is a note on what a reasonable answer sounds like. It applies to any vendor, including us.

Start with what you are protecting

Before talking to a vendor, list what will be in the system. For a typical traffic control company:

Customer data. Contacts, billing addresses, rate sheets, credit terms.
Pricing. Your rates and margins. A competitor would like to see them.
Employee data. Names, phone numbers, certifications, hours and GPS punches.
Job records. Signed daily tickets, photos, locations and times.
Financial records. Invoices, payments, and the connection to your accounting system.

The federal framework most organizations use to think about this is the NIST Cybersecurity Framework, now at version 2.0. NIST describes it as helping organizations better understand and improve their management of cybersecurity risk. You do not need to implement a framework to buy dispatch software. It is useful as a reminder that security covers more than keeping people out. It includes knowing what you have, noticing when something goes wrong, and being able to recover.

Logins

Most real-world problems start with a login, so start there.

Does every user get their own login? The answer should be yes, at no extra cost per user. Pricing that charges per seat pushes companies to share logins, and a shared login cannot be traced or switched off for one person. See per-user vs flat-tier pricing for traffic control software.

Is multifactor authentication available, and can I require it? Multifactor authentication asks for a second proof, such as a code from a phone, in addition to a password. CISA's guidance is direct. Its multifactor authentication page states: "The use of MFA on your accounts makes you 99% less likely to be hacked." Ask whether it is supported, which methods, and whether an admin can make it mandatory.

What are the password rules, and what happens after repeated wrong attempts?

Can I see who is logged in and sign someone out remotely? A phone left in a truck or lost on a job site should not be an open door.

Roles and permissions

Not everyone needs to see everything. A flagger needs today's job and a time clock. A dispatcher needs the board. Very few people need your rate sheet or payroll hours.

Ask:

What roles exist, and can they be adjusted?
Can field users be kept away from pricing and customer financial data?
Who can export data?
Who can delete records, and can deleted records be recovered?
Can approvals be separated, for example one person drafting an invoice and another sending it?

We cover this in detail in user roles and permissions in traffic control software.

The audit trail

When a ticket is disputed or a number changes, you need to know who did what and when.

Is there a log of changes to quotes, tickets, invoices and time entries?
Does it record the user and the time?
Can a signed ticket be altered after signature, and if so is the change visible?
Can pay periods be locked?

The audit trail is as much about disputes as security. See preventing daily ticket disputes and electronic signatures on traffic control daily tickets.

Offboarding

People leave, sometimes on bad terms. Ask the vendor to show you, in the demo, how to remove a user.

Is it one step?
Does it take effect immediately, including on a phone that is already logged in?
Does the departing user's history stay attached to their name?

Then make it part of your own routine. Access comes off on the last day, along with the fuel card and the yard key.

Where the data lives and how it is backed up

Where is the data hosted?
Is data encrypted in transit and when stored?
How often are backups taken, and how long are they kept?
Has the vendor tested restoring from a backup?
If the service has an outage, how are customers told?

Be cautious about promises here. A vendor who quotes a precise uptime figure should be able to show it in the contract.

For field crews, ask what happens with no signal. An app that needs a connection to open a ticket fails in exactly the places traffic control happens. See offline-first field apps for traffic control crews.

Getting your data out

Security includes not being locked in. Ask:

Can I export customers, jobs, tickets, invoices and inventory at any time, in a standard format?
Do photos and signatures come with the export?
What happens to my data if I cancel, and for how long can I retrieve it?
Is that in the contract?

See traffic control software: data ownership and export.

Integrations and payments

Every connection to another system is another place to ask questions.

Accounting. How does the software connect to QuickBooks or your accounting system? What can it read and write? Can the connection be revoked from the accounting side? See traffic control software QuickBooks integration.

Card payments. Does card data pass through the vendor's servers or go directly to a payment processor? Using an established processor keeps card numbers out of the dispatch system. See taking card payments for barricade rentals.

Customer portal. If customers can log in to see tickets and invoices, how is each customer kept from seeing another customer's records? See customer portals for traffic control companies.

Location data

A GPS time clock collects employee location. That is useful and it is sensitive.

When is location recorded: only at punch in and out, or continuously?
Who can see it?
How long is it kept?
Are employees told what is collected?

Rules on employee monitoring differ by state. Ask an employment attorney what notice or consent applies where you operate. See GPS time clock for traffic control crews.

If something goes wrong

How will the vendor notify me of a security incident affecting my data, and how quickly?
Is that commitment in the contract?
Who is my contact?
Has the vendor had an independent security assessment, and can I see a summary?

A vendor who gets defensive at these questions is telling you something. A good vendor has answered them before and has the answers written down.

What you control

The vendor is half of it. The other half is how you use the software.

Give every person their own login.
Turn on multifactor authentication for everyone, starting with owners and office staff.
Give each role the least access it needs.
Remove access the day someone leaves.
Review the user list every quarter.
Do not send passwords or customer login details by text message.
Keep phones and tablets locked with a passcode.

See rolling out traffic control software to your crews for building these into the rollout.

How Traffic OS approaches it

Traffic OS charges flat monthly tiers, $499, $949 or $1,499 as of November 2026, with 10, 25 or 60 people included, so there is little cost reason to share a login. It ships with preset roles for owner, admin, dispatcher, driver, accountant and viewer, permissions set per action, lockable pay periods and an audit log of changes. Card payments run through Stripe or Square. Records can be exported.

We make no certification claims here. Ask us every question in this post during a demo and ask for the answers in writing. If you are comparing against a general field service platform, Traffic OS vs Jobber sets out the differences. See pricing and features for what each tier includes, and traffic control software demo questions to ask for the rest of the evaluation.

Traffic Control Software Security: Questions to Ask Before You Put Your Business in It