Casabe Konnect runs multiple shipping companies on one platform — and every one is walled off from the others at the database level. Here's how we keep your operation's data private, isolated, and under your control.
Every company's data lives behind row-level security enforced by the database itself — not just the app. One company can never read, write, or even see another's orders, customers, invoices, or routes. Isolation is verified with automated cross-tenant tests.
Three roles — HQ, Office, and Driver — each see only what their job requires. Office staff are scoped to their location; drivers see only their assigned route. Payment actions are locked to authorized roles and enforced on the server, never trusted from the browser.
Payments run through your own Stripe account. Card details never touch our servers — checkout happens on Stripe's PCI-compliant infrastructure. Payment amounts are always calculated server-side, so they can't be tampered with from the client.
API keys, payment credentials, and service tokens live in server-side secret storage — never in the code that reaches a browser. Every deploy runs an automated check that blocks any build with a leaked secret.
Most breaches happen when application code forgets a check. We push the boundary down to the database, where it can't be bypassed.
Orders, shipments, invoices, payments, customers, routes — every record carries the tenant it belongs to.
Row-level security policies run on read and write. A request for another company's data returns nothing — the rows simply don't exist for that user.
Automated probes impersonate one company and attempt to read and modify another's data across every table. The expected — and verified — result is zero access, every time.
Invoices and payments are locked to both role and company, so even an authorized user can only ever see their own operation's money.
All traffic runs over HTTPS/TLS. Data moving between your browser, our platform, and the database is encrypted end to end.
Public sign-up and tracking forms are rate-limited and CAPTCHA-guarded, so they can't be abused or spammed.
Every SMS opt-in is stored as a legal consent record with what was agreed, when, and from where — independent of whether a message is ever sent.
Failures are logged and monitored so problems surface fast — instead of silently affecting your operation.
Every release runs an automated gate that verifies the build, blocks leaked secrets, and confirms core tests pass before it can go live.
You can export your orders, customers, and manifests at any time. No lock-in — your data is always yours to take.
We take security reports seriously and appreciate responsible disclosure. If you believe you've found a vulnerability, email us directly and we'll respond quickly.
security@casabekonnect.comPlease give us reasonable time to investigate and address any issue before public disclosure.
Casabe Konnect is a growing platform in active development with live shipping operators. We build security in from the ground up and continuously harden the system. If your organization has specific compliance requirements, talk to us — we're happy to walk through our practices in detail.