Serious SaaS. Not legacy in disguise.

Frontend

Next.js

v16 · App Router

React 19 with Server Components, ISR for reports, and RSC for consistent UX.

UI Layer

TypeScript

v5 · strict mode

Strict TypeScript across the frontend. Shared types between client and server.

Backend

FastAPI

async · Python 3.12

Async backend with Pydantic v2 validation. Auto-generated OpenAPI.

Database

PostgreSQL

v16 · Neon hosted

Versioned schema, indexes verified on every deploy, automatic backups.

Object storage

S3 / R2

Cloudflare R2

Photo evidence with free egress. Optional multi-region backup.

Integration

ERP/DMS REST

REST · OData · SQL

REST connector with OAuth2 or Basic Auth. Multi-connector via versioned profiles.

Hosting

Render

+ Cloudflare

Cloud-native with auto-deploy from main. Global CDN for static assets.

Auth

JWT + Cookie

HttpOnly · SameSite

BFF pattern: the token never reaches the browser as JS. SAML/OIDC SSO on the roadmap.

Robust authentication

JWT in HttpOnly cookie, strict SameSite, configurable expiry, and refresh token. Verified in the middleware on every request.

• ✓Short-lived JWT + refresh token
• ✓Verified in the middleware on every request
• ✓Rate limiting on login (429 on abuse)
• ✓SAML/OIDC SSO on the roadmap

Protected credentials

ERP credentials never reach the browser. Encrypted at rest with authenticated symmetric encryption, accessed only by the authenticated backend.

• ✓Authenticated symmetric encryption at rest (Fernet)
• ✓TLS in transit · HSTS
• ✓Encryption key in an environment variable, outside the code
• ✓No secrets in logs or backups

Immutable audit

Every status change, every ERP call, and every login is recorded with who, when, and what.

• ✓Log of changes per vehicle (who, when, what)
• ✓Production errors and alerts via Sentry
• ✓Configurable retention
• ✓Search by user, event, or resource

Backups and recovery

Point-in-Time Recovery (PITR) via Neon. Daily encrypted backups and a documented DR plan.

• ✓Point-in-Time Recovery (PITR) via Neon
• ✓Target RPO / RTO in Enterprise contract
• ✓Documented restore procedure
• ✓Encrypted backups

Data isolation

Multi-tenant with branch-level row isolation (RLS) and storage isolation. Enterprise tenants can be dedicated.

• ✓Row-Level Security (RLS) per branch in PostgreSQL
• ✓Photo storage separated per tenant
• ✓Dedicated tenant option (Enterprise)
• ✓RLS isolation QA (demo + staging)

Access control

Role-based access control with 13 roles and 35 granular permissions. Branch scopes. Permission changes audited.

• ✓13 preconfigured roles
• ✓Scopes per branch
• ✓Custom permissions in Enterprise
• ✓Immediate revocation