Documentation, valuations and provenance records are sensitive. Here's plainly how we approach protecting them — what's in place today, and what we don't claim.
Sign-in is handled through Supabase Auth. Your session is verified on every request that touches your data — nothing is inferred client-side and trusted blindly.
Our own staff do not have blanket access to customer data. Administrative access is split into five distinct roles (support, data, finance, technical and super admin), and every administrative action is checked against an explicit, server-side list of what that role is allowed to do. There's no fallback "section" permission that could silently grant more than intended — each action is enumerated individually, and anything not explicitly permitted is denied by default.
Viewing a customer's vehicles, valuations, documents or other records requires an active, time-limited access grant — not simply an admin role. A blanket "view everything" path does not exist in our support tooling; access is scoped, expires automatically, and can be revoked.
Administrative actions — access requests, account changes, support access grants and revocations — are written to an audit log. That log cannot be modified or erased by a client-side request: writes are only possible through our controlled server-side process, which is what keeps the log meaningful as a record of what happened.
The single most privileged credential in our infrastructure — the database service key — is used in exactly one place, our server-side administrative function, and is never sent to or stored in any browser. Ordinary product traffic uses a public, RLS-governed key by design: it can only do what our database access rules explicitly allow, regardless of what the client sends.
Where we've built internal tools that summarise customer data for support or operational purposes, we've made a point of excluding fields those tools don't need — including things like raw payment identifiers, vehicle identification numbers, and detailed notes — rather than exposing full records by default.
Card details are handled directly by Stripe, our payment processor. We do not receive or store your full card number.
The application is served over HTTPS and hosted on Supabase (database, authentication and file storage) and Vercel (web application). Data in transit between your browser and our infrastructure is encrypted using standard TLS, consistent with both providers' platform defaults.
Documents you upload to a vehicle's vault are private to your account, plus anyone you explicitly invite as a team member on that vehicle. Team access is role-based (owner, admin, editor or viewer) and can be revoked at any time.
You can request an export or deletion of your account data at any time — see our Privacy Policy for how to do that.
We'd rather under-promise here than over-claim. We do not currently claim SOC 2, ISO 27001, or any formal third-party security certification. We do not use end-to-end or zero-knowledge encryption — our team can, under the controlled access described above, access customer data when genuinely necessary (for support or legal reasons). We do not claim a specific data-residency guarantee beyond what our infrastructure providers publish themselves. Security is an ongoing process, not a finished state, and no online service — including ours — can guarantee absolute security.
We're glad to walk through any of this in more detail.