Platform
Security and tenant isolation
Isolation enforced at the data layer, authentication by a dedicated identity provider, and an audit trail on every write.
Tenant isolation is layered
Every record belongs to an organization, and every query filters by it — explicitly, in application code. Underneath, database row-level security enforces the same boundary again, so even a defective query cannot cross tenants. Two layers, one rule: your data is yours.
Identity and access
Authentication is delegated to WorkOS: session-based sign-in for the dashboard, standards-based OAuth for mobile apps, and hashed API keys for integrations. Inside the platform, roles grant capabilities — dispatcher, finance, fleet manager — and sensitive administrative writes require step-up verification.
- Auth checks run before any handler logic, on every request.
- Role templates ship sane defaults; capability overrides are explicit and audited.
- API keys are stored as hashes and scoped per organization.
PII stays in its lane
Passenger contact details are visible only to the operating organization, enforced in queries rather than hidden in the interface. Phone masking keeps real numbers out of driver and passenger hands alike. Deletion requests soft-delete immediately and purge on a fixed schedule.
Audit as a first-class record
Every write and every sensitive read lands in the audit log with actor, organization, and request context. Compliance reviews start from evidence you already have.