Request Access
Security

Your data stays
yours alone.

Casabe Konnect runs multiple shipping companies on one platform — and every one is walled off from the others at the database level. Here's how we keep your operation's data private, isolated, and under your control.

🔒

Tenant isolation by default

Every company's data lives behind row-level security enforced by the database itself — not just the app. One company can never read, write, or even see another's orders, customers, invoices, or routes. Isolation is verified with automated cross-tenant tests.

🛡️

Least-privilege access

Three roles — HQ, Office, and Driver — each see only what their job requires. Office staff are scoped to their location; drivers see only their assigned route. Payment actions are locked to authorized roles and enforced on the server, never trusted from the browser.

💳

Payments you control

Payments run through your own Stripe account. Card details never touch our servers — checkout happens on Stripe's PCI-compliant infrastructure. Payment amounts are always calculated server-side, so they can't be tampered with from the client.

🔑

Secrets stay secret

API keys, payment credentials, and service tokens live in server-side secret storage — never in the code that reaches a browser. Every deploy runs an automated check that blocks any build with a leaked secret.

Under the hood

Isolation, enforced by the database.

Most breaches happen when application code forgets a check. We push the boundary down to the database, where it can't be bypassed.

01

Every row is tagged to a company

Orders, shipments, invoices, payments, customers, routes — every record carries the tenant it belongs to.

02

The database checks on every query

Row-level security policies run on read and write. A request for another company's data returns nothing — the rows simply don't exist for that user.

03

We test it, not just trust it

Automated probes impersonate one company and attempt to read and modify another's data across every table. The expected — and verified — result is zero access, every time.

04

Financial data gets extra scoping

Invoices and payments are locked to both role and company, so even an authorized user can only ever see their own operation's money.

Practices

Careful by habit.

Encrypted in transit

All traffic runs over HTTPS/TLS. Data moving between your browser, our platform, and the database is encrypted end to end.

Bot-protected public forms

Public sign-up and tracking forms are rate-limited and CAPTCHA-guarded, so they can't be abused or spammed.

Consent, on the record

Every SMS opt-in is stored as a legal consent record with what was agreed, when, and from where — independent of whether a message is ever sent.

Error tracking, not error hiding

Failures are logged and monitored so problems surface fast — instead of silently affecting your operation.

Pre-deploy safety checks

Every release runs an automated gate that verifies the build, blocks leaked secrets, and confirms core tests pass before it can go live.

Your data is exportable

You can export your orders, customers, and manifests at any time. No lock-in — your data is always yours to take.

Found something? Tell us.

We take security reports seriously and appreciate responsible disclosure. If you believe you've found a vulnerability, email us directly and we'll respond quickly.

security@casabekonnect.com

Please give us reasonable time to investigate and address any issue before public disclosure.

Casabe Konnect is a growing platform in active development with live shipping operators. We build security in from the ground up and continuously harden the system. If your organization has specific compliance requirements, talk to us — we're happy to walk through our practices in detail.