Every row has a tenant. Every query checks it.
liverybook is multi-tenant: one application, one database, and a tenant id on every one of the 48 tables except three append-only logs. Isolation is enforced in the ORM's default manager, so a query that forgets the tenant does not return the wrong operator's data; it returns nothing. This page states only what is built. Items still being decided are listed as such.
What the code enforces today.
Tenant isolation in the ORM
Every record carries a tenant id and the default manager filters by the current tenant on every query. Views never pass a tenant id by hand; the request's tenant is resolved from the JWT claim, the subdomain or the custom domain, in that order, and set once per request.
Three separate identity systems
Operator staff, portal users and drivers authenticate with JWTs from separate issuers. A portal token cannot call an operator endpoint. API keys are hashed with bcrypt, looked up by an 8-character prefix, and carry explicit scopes.
Email credentials encrypted at rest
Per-tenant Postmark and SendGrid credentials are stored as a Fernet-encrypted blob with the key held outside the database. The API returns only the last four characters.
Append-only where it matters
Trip status events and the audit log are write-once tables, partitioned monthly, never pruned. Money moves only through transaction records; balances are recomputed, never edited.
Soft delete
Deleting a record sets a flag and a timestamp. Nothing a dispatcher removes is gone; it is excluded from the tenant's queries.
Rate limits
Login attempts are limited to 10 a minute, GPS batch writes to 60 a minute, and API keys to 1,000 requests an hour.
What we will publish once it is true.
These depend on the production hosting decisions and are deliberately not claimed here. Ask on the demo and we will tell you the current state plainly.
- Hosting region and data residency (planned: US, PostgreSQL 15 with PostGIS, Redis 7, S3-compatible storage).
- Backup schedule and retention.
- Encryption in transit and at rest for the database and object storage.
- Status page and incident communication.
- SOC 2 or equivalent attestation, if pursued.
Security contact: security@liverybook.com.