SECURITY

Dealer-Grade Protection.
Zero Compromise.

Your shop data, customer records, and diagnostic evidence are protected by row-level isolation, validated inputs and append-only audit logs — built with the same rigor we apply to torque specs.

Multi-Tenant Row-Level Security (RLS)

  • •Every database table enforces shop-level isolation — your data never leaks to another shop.
  • •Access rules are enforced in the database with row-level security, not only in the app.
  • •Admin-only delete permissions prevent accidental or malicious data removal.

Schema-First Input Validation (Zod)

  • •All inputs are validated at the boundary using strict Zod schemas before touching the network.
  • •VIN fields enforce ISO 3779 (17-char, no I/O/Q). Chat inputs are stripped of HTML to neutralize XSS.
  • •Job IDs enforce UUID v4 format to prevent sequential ID prediction (IDOR attacks).

Append-Only Audit Logs

  • •Every sensitive action (data views, exports, consent events) is recorded in an append-only ledger.
  • •Logs capture User Agent, IP, timestamps, and asset IDs — satisfying enterprise compliance requirements.
  • •RLS policies enforce insert-only access — no client, and no user of any tier, can update or delete a log row.

Rate Limiting & API Protection

  • •Diagnostic endpoints enforce a 60 requests/minute sliding window per IP to prevent resource exhaustion.
  • •External API access requires x-api-key authentication with partner-level credentials.
  • •Overflow returns 429 Too Many Requests with a retry_after cooldown.

Automated Security Testing

  • •Fuzz testing with SQL injection, XSS payloads, command injection, and multi-KB buffer attacks.
  • •Automated E2E security suites verify input validation, rate limiting, and WSOD prevention.

Infrastructure

  • •Data is hosted on production-grade PostgreSQL infrastructure with encryption at rest and in transit.
  • •Edge Functions process diagnostic requests at the network edge for low-latency and geo-compliance.
  • •Service Worker ensures offline functionality — your shop runs even when the internet doesn't.

Responsible Disclosure

Found a vulnerability? We take security reports seriously. Contact us directly and we'll respond within 24 hours.

service@lanepilot.io