Platform/12/Security and tenancy
12 Security and tenancy
Your data in its own database. Your people behind your identity provider.
A dealer group is a tenant with its own database, its own subdomain and its own settings. Above it sits a control plane that provisions, licenses and monitors without ever holding operational data. Sign-in is Microsoft Entra ID, permissions are layered, devices are registered, partner traffic is signed, and the records that matter do not move.
/ Works with
01 Tenancy
One database per dealer group.
A control plane above them all.
Isolation by database, not by column
Each master dealer's operational data lives in its own database; the request resolves the tenant from the control plane and switches the connection. Sub-brands inside a master live in mirrored tables and never see each other; payroll, punches and discipline are among the tables that never leave the tenant.
Store authorization
A store is authorized to a dealer group and a sub-brand before any data flows for it. Partner and carrier rows resolve to their store by door code, then to the tenant, one row at a time, on our side.
Modules and licenses
Modules are activated by the landlord for a master dealer, then by the master for its sub-brands; nothing self-provisions. New modules ship dark and turn on per group, with an app-wide switch above every one of them.
02 Identity
Sign in with Microsoft.
Verify who you hire.
Entra ID single sign-on
One registered redirect serves every dealer subdomain: the originating host rides the callback in a short-lived encrypted cookie, so a user lands back where they started. Password login remains only until every user is covered; Microsoft-only is the end state.
Provisioning
Where enabled, a new hire's Microsoft account is created from the onboarding flow with the internal email as the login key, so the first login is already single sign-on.
Identity verification and the legal gate
Government ID and selfie verification on production keys during onboarding; we keep the decision, not the documents. Terms, privacy and content-usage are accepted on first login, on the web and in the app, per user.
Carrier and landlord staff
Carrier account managers use a one-time email code on their own panel with no account on our side. Landlord staff use a separate guard and a separate database.
03 Permissions
Five layers decide
what a person sees.
| Layer | Question | Where it is set |
|---|---|---|
| Role | Which permissions does this person hold? Rep, manager, district, area, regional, finance, HR, owner, super admin. | Roles and a permission matrix, per dealer group |
| Store scope | Which stores may they see? Their own, their territory, their region, an overlay pool, everything. | Store master, tier assignments, overlays |
| Module | Is this capability switched on for this dealer group? | Landlord module matrix, master dealer sub-brand matrix |
| Feature | Is this page or action enabled for this role in this group? | Feature registry and page gates |
| Tier | Does their management tier unlock this? Tiers are re-derived nightly from the store master. | Nightly role reconciler, with named exceptions |
Dollar figures stay behind a payout visibility gate until the week closes. A read-only gate exists for roles that may look but never write.
04 Devices and APIs
A phone can be lost.
A signature cannot be guessed.
Device trust
Phones registered per user with OS and build; a lost handset revoked without a password reset; biometric unlock gates the local session for the trust window.
Single-device policy
Where enabled, enrolling a new phone signs the previous one out by revoking its token, with an approval queue for the swap. Old builds retire through a gate that fails to no gate, never to a wall.
Signed partner traffic
Partner pulls are signed requests; inbound webhooks are verified against a shared secret before the payload is trusted; partner keys are stored as hashes with scopes and an optional IP allow-list.
Tokens
Mobile and portal sessions are bearer tokens with expiry and rotation. We issue the OAuth token the shipping carrier's webhook client presents to us.
Secrets
Credentials live in environment configuration and the landlord's integration vault, never in the repository. A public exposure audit closed the web root to application files and rotated the affected credential the same day.
Uploads
Documents, signatures and photos go to object storage on tenant-scoped paths and stream only through an authenticated route, never a public URL.
05 Platform
Edge, storage,
monitoring, backups.
Cloudflare
DNS with wildcard subdomains so a new dealer group needs no DNS work, TLS at the edge, DKIM, SPF and DMARC for deliverability, and R2 object storage for uploads.
Monitoring
Exceptions tagged by dealer group in Sentry, supervised queue workers with a dashboard, a landlord health monitor, a scheduler audit for silent skips, and collectors that report when they return nothing.
Backups and archiving
Nightly database backups, a snapshot before any bulk change, and an archiving routine for the tables that grow by the hour.
06 Records
What is written
stays written.
Locked pay weeks
A locked commission or payroll week is immutable at the service layer. Corrections post forward on the next open week with the reason kept.
Append-only ledgers
The reward ledger and the deduction ledger are never updated or deleted. A correction is a compensating entry.
Worked time
Punches are never hard-deleted. A reconciled punch is soft-removed with a marker that says why.
Audit logs
A landlord audit log for control-plane changes, a ticket audit log per ticket, a manual-edit log for anything done by hand.
Soft deletes
Operational records soft-delete by rule so a report can always explain a number that used to be there.
Retention
Raw presence pings roll up after a retention window; documents and signatures keep for as long as the employee record does.
07 Related
Integrations and APIs
Carrier, POS, bank, supplier and shipping feeds on signed APIs, 105 scheduled jobs.
/ 10Mobile apps
iOS and Android, one app with a face for every role, push, device trust.
/ 08Forms, PDFs and onboarding
Form builder, fillable PDFs, e-signature, identity verification, legal gate.
/ allEvery platform page
The twelve deep dives, one per capability, with the overview above them.
→ Start
Send us your
security questionnaire.
We answer it against what is actually running, and show you the tenancy on a real dealer group with the data redacted.
Request a demo