Security

How your records are handled.

Written for the person who has to sign off on this before the fleet moves over, including the parts that aren't finished.

Authentication

Passwords

Hashed, never stored in plaintext, never logged. Password reset is token-based with a short expiry.

Google sign-in

OAuth 2.0. If the Google address matches an existing account we link them rather than creating a duplicate.

Sessions

Server-side, stored in Redis with a 24-hour sliding expiry. Deactivating a user kills their live sessions immediately rather than waiting for expiry.

Email verification

Required before a new account can sign in. Resend is rate-limited.

Separation

Multi-tenancy

Every record is keyed to an organization. Queries are scoped by organization at the data layer, not filtered in the UI.

Authorization

Checked in middleware on every incoming request against the user's roles in the organization they're currently viewing, not the one they last logged into.

Roles

System roles plus custom roles per organization. Additive. An organization admin cannot grant themselves system-wide access.

Data

Documents & photographs

Stored in object storage, served through the application rather than from a public bucket.

Vehicle data

VIN decoding uses the NHTSA vPIC API, a public US government service. We cache responses. Your VIN is sent to that service to decode it.

Export

Full export in open formats on every tier, including free.

Deletion

Ask and we delete. Not deactivate, not archive.