Security

Security is not a feature added later

Fleet data exposes your whole business: locations, customers, prices. That is why the platform was built security-first — this page is documentation, not marketing.

  • Multi-factor authentication (TOTP)Server-enforced, not a cosmetic option — with policies per privilege level.
  • Tamper-evident audit logA hash chain makes any retroactive edit mathematically detectable.
  • Strict tenant isolationA database-level write guard, and an architectural rule: TenantId is never read from the request.
  • Rate limiting & account protectionLogin throttling, account-takeover protection, and per-endpoint rate limits.
  • A unified API gatewaySeparates internal service keys from customers — no internal key ever leaves.
  • Recurring security scansSecret scanning in the build pipeline and periodic Snyk scans of dependencies and code.
  • Hosted inside the KingdomData does not leave Saudi Arabia — an architectural decision from day one.
Responsible disclosure: Found a vulnerability? Email us at security@pixa-sa.com