02 — Security & data protection
Bank-grade by design, not by checkbox
Tenant isolation, signed credentials, and a complete audit trail — built specifically for the accountability that recovery work demands.
Per-agency data isolation
A genuinely separate database per agency (crmr_<agency>) — one agency can never see or touch another's records.
Token-based auth, everywhere
HMAC-signed access tokens route apps only to their own database. No request reaches data without a valid, signed credential.
Encrypted transport (TLS 1.3)
All traffic runs over HTTPS / TLS 1.3 with auto-renewing certificates. Nothing travels in plain text over the network.
Device-locked agent logins
Each login binds to a single device. A device change requires an OTP plus admin approval, so a lost phone can't sign in elsewhere.
Email OTP verification
Agency registration and admin sign-in are protected by one-time codes — no password-only access to sensitive areas.
Anti-spoofing email
Outgoing mail is signed and verified with SPF + DKIM + DMARC, so notifications can't be spoofed and reliably reach the inbox.
Role & finance-level access
Admins and agents hold different rights, and agents can be restricted from specific financers — they only see what they're authorized to.
Server-enforced controls
Accounts can be activated, stopped, or blacklisted instantly, and subscription expiry is enforced server-side — checked continuously, not just at login.
Full audit trail
Who searched, which vehicle, where, and when — captured with both device and server time, and encrypted mailbox storage at rest.
Database
Isolated per agency
A separate database per tenant — no shared rows, no cross-agency reach.
Access
Credential-gated
Never exposed to the public internet — only the auth'd app layer can reach it.
Speed
Indexed & scalable
Purpose-built indexes return searches over millions of records in milliseconds.
Integrity
Maintained counters
Record counts and relationships stay consistent on every upload and delete.
