The query itself carries the company
Every read and write of tenant data is filtered by company id in the code, with no trusted caller exempt from it. This is the layer that does the work - not a setting, but a condition on the statement.
Where it lives
Named places, not a reassuring adjective.
Every service that holds any part of your data, and what each one holds. Traffic to all of it runs over TLS.
- Database
- Supabase Postgres, Ireland (eu-west-1)
- Documents
- Private bucket, reachable only through short-lived signed links
- Company logos
- Public bucket, so they render in email - SVG is refused
- Application
- Railway (API) and Vercel (front end)
- Sign-in
- Google Firebase Authentication
Keeping operators apart
One database, and a company that cannot see another.
This is the failure that would matter most in software like this, so it gets two independent mechanisms rather than one - and an honest note about how far each of them reaches.
The database enforces it again
Row-level security sits underneath as a second line, so a query that forgot its filter is refused rather than answered. It covers the request lane, which is the lane that serves a signed-in user. The owner and infrastructure lanes are not behind it, which is why the filter in the code - not the policy - is treated as the real defence.
Roles gate what a user may do
Permissions are checked per action, not per screen: hiding a button is not access control. Enforcement is on in production.
API keys start with nothing
A key reaches only the scopes you granted it and is refused everywhere else by default. Keys carry their own rate limit and are revocable, and the parts of the product that write into your account from a file are closed to them entirely.
Getting in
Passwords are the weakest way in, so they are not the only way.
Sign-in runs on Google Firebase Authentication: email and password, Google sign-in, an authenticator app for two-factor, or a passkey tied to the device. Where a user has turned two-factor on, it is checked on every request for the life of that session and not just at the login screen - a valid sign-in token on its own does not get through. Two-factor is a per-user choice today; you cannot yet force it on everyone in your company from one switch.
Who else touches it
Every sub-processor, named.
Named companies rather than a phrase like a specialist provider. If this list changes, it changes here and in the privacy policy at the same time.
- Anthropic
- AI parsing of enquiries and draft quotes
- Stripe
- Card payments and subscription billing
- Maps and routing, Firebase sign-in, push delivery
- Supabase
- The database and document storage
- Railway
- Runs the API
- Vercel
- Serves the front end
- ImprovMX
- Our own billing and support mail - never your client mail
- AeroDataBox
- Flight status, only if you switch flight tracking on
- Sentry
- Error reports, with personal data off and no session replay
The honest part
What we do not have.
We hold no ISO 27001 certification and no SOC 2 report, and we have not commissioned an independent penetration test. Row-level security protects the lane that serves signed-in users and does not cover the infrastructure lanes. Two-factor cannot yet be mandated across a whole company - each user turns it on. The database is in Ireland; the rest of the stack we host where it runs, and we will not stretch that into a claim about the whole system. If any of this is disqualifying for a contract you are chasing, better that you learn it from this page.
The full legal detail lives in the privacy policy and the terms. Questions a page cannot answer go to hello@4fleet.io.
Questions
Where is my data stored?
The database that holds your bookings, clients and invoices runs in Ireland. The application that talks to it is hosted separately, and we are not going to describe the whole stack as EU-resident when the honest answer is that the database is the part we can point at.
Who at 4fleet can see my bookings?
Nobody can sign in as you: impersonation does not exist in the product, so it cannot be misused. Your bookings, clients and invoices are not readable from any internal screen either - reaching them means going to the database directly, which is a deliberate act by whoever operates the service, not a button somebody presses while answering a ticket. The exception is the ticket you raise yourself. A named allow-list of platform operators can read support tickets across companies, including whatever you attach to one, because otherwise nobody could answer them; every one of those reads is logged before it happens.
Does the AI train on my data?
No. Enquiries are sent to Anthropic to be parsed and to draft a quote back, and that is the whole transaction. What it returns is a draft that waits for you.
Can I delete everything?
Yes, from inside the product rather than by emailing a request and hoping. Deleting the account removes the data rather than flagging it hidden.
Do you hold ISO 27001 or SOC 2?
No. Neither, and no third-party penetration test report either. If a certificate is a hard requirement for your client, we are not the right answer for that contract today and would rather say so now.
What happens if you have a breach?
We tell you, in the timeframe the GDPR sets, with what we know at the time rather than after a month of drafting. Our data processing terms are part of the agreement you accept when you sign up.