A six-truck company does not buy twelve iPads. It buys six, mounts one in each cab, and whoever is driving that truck uses it. That is the right call for the budget and the wrong call for the records, because the tablet is signed in as somebody, and that somebody is on every service report, DVIR and photo for every driver who touches the truck. Three months later, nobody can say who serviced the unit on the Tuesday the customer is asking about.
The restaurant POS model
Restaurants solved this decades ago. The terminal is signed in as the terminal. The server enters a four-digit PIN and the order is theirs. Walk away, enter another PIN, and the next order belongs to someone else. Nobody creates a login per server per terminal.
The same model works in a truck. The iPad is signed in as the truck: Truck 12, with its own login that is never a person. When a driver gets in, they tap their name on a roster and enter a PIN. From that moment every job completion, photo, pin move, pre-trip and punch is attributed to the driver. When the next driver takes the truck, they tap their name and the records switch.
PIN entry is clock-in
The sign-on and the time clock should be the same tap. A driver who PINs in at 6:42 is clocked in at 6:42; clock-out at the end of the shift ends the session and returns the iPad to the roster. That gives you a timesheet from the same gesture that gives you attribution, and it means a driver cannot be "on the truck" without being on the clock. The punch should record that it came from the device, so a timesheet can tell a truck sign-on from a phone sign-on.
Two edge cases to get right. A driver already clocked in on their own phone who then PINs in on the iPad should see the open shift, not start a second one. And if the office switches a driver's time-tracking off mid-shift, they should still be able to clock out.
What the truck login can and cannot do
The truck is a login, never an assignee. No job is ever assigned to "Truck 12"; jobs are assigned to people, and the truck is what they are driving. Every people picker in the office should leave truck logins out. The truck login also has no email and no phone, so nothing is ever sent to it; notifications go to the driver who is signed on, and a push to that driver should reach the iPad they are currently acting on as well as their own phone.
Dispatch should see who is in which truck
The payoff for the office is a live answer to "who is in Truck 12 right now". The dispatch board shows each driver with the truck they signed on to and the time, so a reassignment goes to the right person without a phone call. If the roster shows Truck 12 with nobody signed on at 7:15, that is information too.
Security that fits a cab
A PIN is four to six digits. Five wrong tries locks it for fifteen minutes. The office sets a driver's first PIN and the driver can change it from their own profile. An idle lock, off by default, can ask the same driver for the PIN again after a set number of minutes, for companies that park with the iPad in the cab. Retiring a device locks the truck login and keeps its history, because the punches reference it.
Why not just buy more seats
On per-user pricing, a second tablet per truck doubles the device cost and adds a seat per driver, and you still have drivers sharing a login the week a tablet breaks. On a per-company price the truck login and every driver's PIN are included, and the question goes away. The per-user pricing post does the arithmetic.
The record that matters most on the shared iPad is the pre-trip inspection, because it is a DOT record with a name on it. That post is next.
