Security at Fuel Relay

All traffic between the mobile app, the dashboard, and our servers uses TLS. The mobile app additionally pins our server certificates, so it refuses to talk to an impostor even on a hostile network. Data is encrypted at rest by our database provider.

Every table is protected by PostgreSQL row-level security, scoped to your organization. Isolation is enforced in the database itself, not just in application code, so one company's fuelers and logs are invisible to every other company at the lowest layer we control.

Every change goes through checked server code. Privileged keys live in server-side vaults only; the browser and the mobile app never hold them.

• Passwords are hashed and never stored in plaintext, and every session is verified against the authentication server on each request, not just trusted from a cookie.
• Sensitive actions (deactivating a fueler code, erasing a fueler's data, exporting the audit log, changing billing or email, deleting the account) require a fresh password re-entry, valid for five minutes.
• Fueler access codes are bound to a device. The app is built to verify itself with Google Play Integrity. This switches on with the Play Store release.

An audit log of important actions that no one in your company can edit. IP addresses and device details are removed after 90 days for privacy. Admins can review and export their organization's log from the dashboard, which makes disputes about a fueling entry a lookup instead of an argument. Until they are removed, the IP addresses and device details are used only for our own security investigations and are never shown to admins.

Billing is handled by Stripe. Card numbers are entered on Stripe's own checkout pages and stay there; they never touch our servers.

The database is backed up every night. Each backup is encrypted before it is stored, is checked for tampering when it is opened, and is kept for 30 days in private storage on GitHub.

• The dashboard ships a strict Content-Security-Policy with per-request nonces, HSTS, and frame denial. The only third-party code on our pages is Vercel Web Analytics and Speed Insights (cookieless visit and page-speed statistics), our error monitoring (Sentry, bundled into our own code), and, only while bot protection is switched on, Cloudflare Turnstile on the sign-in forms. No Stripe script loads: payments happen on Stripe's own pages.
• CSRF protection covers every state-changing request.
• Website error reports lose access codes, email and IP addresses, record IDs and web-address query strings before they are sent. The app's crash reports from its own code are scrubbed on the phone the same way for codes, addresses and query strings, and lose names, locations, trucks and record IDs from their labelled fields; a crash inside the phone's own system software is reported without that scrubbing, with no fuel data added. The app does no usage or session tracking.

We have not yet completed a formal SOC 2 audit, and we will not claim one until we have. Our controls are built around the same principles: least privilege, tenant isolation, change auditing, and encryption by default. For GDPR, we offer a Data Processing Agreement and publish our sub-processor list.

Found something? See our responsible disclosure policy or email security@fuelrelay.net. Good-faith research is protected by our safe harbor.