Security & Compliance

Security Policies

FleetGuard is built with security as a first-class concern. Every layer — from database rows to edge functions — is hardened, audited, and isolated.

Encryption

AES-256 encryption for all data at rest
TLS 1.3 for all data in transit
Encrypted database backups with 7-year retention
API keys hashed with SHA-256

Data Isolation

Row-level security (RLS) isolates every workspace
Tenant-scoped queries via owner_id = auth.uid()
Plaid access tokens restricted to service_role only
No cross-tenant data leakage possible

Audit & Logging

Immutable audit log for every write operation
365-day audit retention with searchable exports
Server-authoritative audit inserts (no client writes)
Webhook events verified via HMAC signatures

Infrastructure

Hosted on Billslash Cloud (Supabase + Cloudflare)
Edge runtime for serverless API handlers
DDoS protection and rate limiting at edge
Automated vulnerability scanning

Row-Level Security (RLS) Summary

All tenant-scoped tables enforce RLS policies keyed to owner_id = auth.uid(). Work orders additionally allow SELECT/UPDATE for assigned technicians via assigned_to = auth.uid().

Users can only read/write their own workspace data

Admins can manage roles but cannot self-promote

Audit logs are append-only via server functions

Plaid tokens are never exposed to authenticated clients

Stripe billing mutations are server-authoritative