Security

Built secure
from day one

Multi-tenant SaaS handling logistics business data deserves real security thinking — not just an SSL badge and a privacy policy.

Below: how CyVeR's security is structured, with real numbers from the systematic audits we've done.

Query sites audited

Every database read and write reviewed for tenant isolation.

XSS sites hardened

HTML output to PDFs and emails escaped at every interpolation point.

Audit log coverage

Every privileged operation writes an immutable audit row.

PIPEDA

Data residency

Canadian-hosted infrastructure with PIPEDA-aware design.

Tenancy Auth & RBAC Audit log Input & XSS Secrets Hosting Privacy Disclosure

01 · Multi-tenancy

Tenant isolation

Every database query, every API endpoint, every email is scoped to the tenant making the request. Customer A's data is never visible to Customer B's users.

Enforced at the query layer with tenant ID on every read and write. Multi-tenant isolation has been systematically audited across all 448 database query sites in the codebase.

Per-query enforcement — findFirst({ where: { id, tenantId } }) instead of unscoped findUnique
705+ tenantId references across services and controllers — defense in depth
Resource-isolation tests — automated tests assert cross-tenant access returns 404
Per-tenant feature flags — features can be turned on per customer without code changes

Pattern

trip.controller.js

const trip = await prisma.trip.findFirst({
  where: {
    id: req.params.id,
    tenantId: tid(req)  // ← always scoped
  },
  include: { driver: true, truck: true }
})

if (!trip) return res.status(404).json(...)
// Cross-tenant access returns 404, not 403
// — does not confirm trip exists in another tenant.

02 · Auth & access control

Authentication & RBAC

Passwords are hashed with bcrypt. JWT tokens have a token-version field so password changes instantly invalidate every existing session. Role-based access control on every endpoint, with six distinct roles.

bcrypt password hashing with cost factor 12
Login rate-limited per IP — brute-force protection
Constant-time comparison against decoy hashes prevents user-enumeration timing attacks
JWT tokenVersion — incrementing the user's tokenVersion invalidates every existing JWT instantly
QuickBooks OAuth state uses crypto.randomBytes(32), server-stored, single-use, 15-minute expiry
Driver app JWT — 72-hour expiry (down from 7 days for tighter rotation)

Six-role RBAC

Per-endpoint enforcement

Superadmin

Cross-tenant access · platform admin

Admin

Full tenant access · settings + users

Dispatcher

Orders, trips, dispatch, invoices

Driver Manager

Drivers, trucks, trailers

Accountant

Invoices, AR, customers

Viewer

Read-only · minimal scope

03 · Audit log

Immutable audit trail

Every privileged action writes to the AuditLog table. User creation and updates, settings changes, integration connections, password events, manual email sends, trip cancellations.

Audit metadata is whitelisted to prevent accidental capture of sensitive fields like password hashes. Full traceability for compliance and dispute resolution.

Tenant-scoped — admins see their tenant's audit; superadmins can see across
Whitelisted metadata — only specific fields per action type are captured; passwords never appear
Performed-by tracking — every entry includes user ID and human-readable name at the time of action
UI access — admins read the audit log directly from the Compliance section

Audit Log

Last 24 hours

42 events

admin@maplefoods·Updated user role

rohit.s → Dispatcher