Security

Kelviz is built for fleet operators handling reservation and toll data across multiple organizations, so isolating each organization's data from every other organization is a core design constraint, not an add-on.

Data isolation

Every table that holds organization data is protected by database-level row-level security (RLS), enforced by Postgres itself on every query — not filtered in application code, where a missed check could leak another organization's data. A request authenticated as one organization's user cannot read or write another organization's vehicles, reservations, tolls, or reimbursement records, regardless of what the application layer does or doesn't check.

Encryption in transit

All traffic to Kelviz is served over HTTPS, with HTTP Strict Transport Security (HSTS) enabled so browsers refuse to fall back to an unencrypted connection.

Application security headers

Every response includes a Content Security Policy, X-Content-Type-Options, X-Frame-Options, a strict Referrer-Policy, and a Permissions-Policy that disables camera, microphone, and geolocation access outright, since none of those are used anywhere in the product.

Payment data

Kelviz never stores card numbers, bank account details, or other raw payment instruments. Billing is handled by Stripe; only a Stripe customer/subscription reference is stored, and card entry happens on Stripe's own hosted Checkout or Billing Portal, never inside Kelviz's own forms.

Audit logging

Sensitive account and billing changes — organization settings, membership changes, plan-limit overrides — are recorded in an append-only audit log scoped to each organization, so an operator can see what changed, when, and by whom.

Reporting a security issue

If you believe you've found a security vulnerability, email security@kelviz.app with details. We don't yet run a formal bug bounty program, but we take every report seriously and will respond directly.