Trust

Security at FleetAxis

FleetAxis is a multi-tenant SaaS for rental and festival operators. We take our role as data custodian seriously. This page summarizes the controls we have in place today. We update it as our posture changes.

Last updated: 2026-06-18

Tenant isolation

FleetAxis enforces FORCE ROW LEVEL SECURITYon all 350 database tables. Every query that reads tenant data must run under a session set to that tenant's ID — the database itself rejects unscoped queries. This is enforced at the database level, not the application level, so tenant isolation survives application bugs.

A static-analysis rule (fleetaxis/no-bare-db-in-rsc) flags any code that attempts a tenant-scoped query without the wrapping context — preventing regressions at write time. A canary cron job continuously verifies tenant isolation in production.

Encryption

In transit — TLS enforced on all connections. HTTP requests are redirected to HTTPS at the edge.
At rest — Database storage (Neon Postgres) is encrypted at rest with AES-256.
Application-level secrets — Payment gateway credentials are individually encrypted with AES-256-GCM using a primary key plus a rotation-window previous key. Key rotation does not require downtime.

Authentication + access control

Multi-factor authentication — TOTP-based MFA available for all users; enforceable per-tenant.
Role-based access control — Five default roles (Super Admin, Admin, Manager, Staff, Client) plus a fine-grained permission key system (38 keys, dot-notation). Granted permissions are evaluated on every server action.
Instant session invalidation — Role or password changes immediately invalidate existing sessions on all devices.

Observability + audit

Every privileged action is recorded in a tenant-scoped audit log. Errors are tracked in Sentry. Product analytics (PostHog), web vitals (Vercel Analytics), and a custom availability canary cover the rest of the surface.

Vulnerability disclosure

If you have found a security issue, please email security@fleetaxis.com with details. We will acknowledge within one business day.

We do not currently operate a paid bug-bounty program. We do thank researchers in our changelog when a report meaningfully improves our posture (with consent).

Sub-processors

The following third parties may process customer data on our behalf. We require all sub-processors to maintain industry-standard security controls.

Sub-processor	Purpose	Data	DPA
Vercel	Auto-accepted on signup	All in transit / compute	✅ DPA executed
Neon		All Postgres at rest	✅ Available on request
Stripe	Auto-included	Payment data + PII	✅ DPA executed
QuickBooks (Intuit)		Financial + customer info	✅ Available on request
Twilio		Phone numbers + SMS content	✅ Available on request
Sentry		Errors + PII in stack traces	✅ Available on request
Slack	Enterprise DPA	Webhook payloads (PII risk)	✅ Available on request
Upstash	Available on Pro	Rate-limit keys + sessions	⚠ Standard ToS — request DPA
Inngest		Event payloads + job metadata	⚠ Standard ToS — request DPA
Resend		Email addresses + content	⚠ Standard ToS — request DPA
SignWell		Signatures + document content	⚠ Standard ToS — request DPA
Duffel		Travel booking data	⚠ Standard ToS — request DPA
PostHog	Verify active first	Analytics events + user identifiers	⚠ Standard ToS — request DPA
GoDaddy		DNS only	N/A — no customer data

Compliance status

We are not yet SOC 2 audited. We have completed a formal SOC 2 readiness sweep against Common Criteria CC1–CC9 plus Availability and Confidentiality Trust Service Criteria, and we maintain a public roadmap of gap closures driven by that assessment. Our intent is to pursue Type I attestation once we have a customer commitment that requires it.

If you require a security questionnaire response or a copy of our subprocessor list with executed DPAs, please email security@fleetaxis.com.

Incident response

We follow a documented incident response procedure with defined severity levels and customer-communication SLAs. For confirmed data breaches, we commit to notifying affected tenant administrators within 72 hours of confirmation, in line with the GDPR notification standard, regardless of whether GDPR applies.

Real-time service status is available at our status page once published. Historical incidents are summarized in our changelog.

Tenant isolation

Encryption

In transit — TLS enforced on all connections. HTTP requests are redirected to HTTPS at the edge.

At rest — Database storage (Neon Postgres) is encrypted at rest with AES-256.

Application-level secrets — Payment gateway credentials are individually encrypted with AES-256-GCM using a primary key plus a rotation-window previous key. Key rotation does not require downtime.