Separated in the database, not on the screen
Most of what follows is ordinary good practice. It is written down because in this market it is often claimed and rarely specified, and because you are about to put your customers' cars, your staff's documents and your day's cash into it.
One business cannot reach another
- Separation is enforced by the database on every row, not by the screen deciding what to draw
- A request for data belonging to another business returns nothing, whatever it asks for
- We test this by signing in as a real low-privilege user and trying, not by reading the rules
Inside your own business
- A field technician cannot see takings, report history or the customer book
- A permission is only offered on screen if the database actually enforces it
- Payments are written once; no role can delete one, including ours
- A closed day stays closed and cannot be quietly reopened or backdated
Reports and photographs
- A report opens with a reference and a PIN — a plate number is not a key
- The link stops working 30 days after issue
- Photographs are not public files; they are served only with the report
- Public lookups are rate limited, so the reference cannot be guessed at scale
Accounts and passwords
- Passwords are stored encrypted by our identity provider; we cannot read yours
- Everything is served over an encrypted connection
- Our own administration console requires a second factor and signs itself out when idle
- No card numbers or bank credentials are stored anywhere in the system
What is not in place yet
FahsLink is pre-launch and still runs on its suppliers' free plans, which is a deliberate budget decision while building. Before the first paying account is opened we are moving to paid plans with daily backups and point-in-time recovery, and running a restore drill to prove the backups actually restore. Until that is done we would rather tell you than let you assume it. If you are considering FahsLink now, ask us where this stands and we will give you the current answer.
Found something?
If you believe you have found a security problem, write to support@fahslink.com with enough detail to reproduce it. We will acknowledge within one working day, keep you informed, and will not take action against anyone who reports a genuine issue in good faith.