Security

One operator, one deployment

Every operator runs on a dedicated deployment with its own database. There is no shared multi-tenant database where a bug could leak one operator's data to another — isolation is physical, not a filter in a query.

Card numbers never touch our servers

All card and PayTo collection happens on Stripe or Square's PCI-DSS-compliant infrastructure. Carz stores only the provider's payment tokens and each charge's outcome. A breach of a Carz deployment cannot expose a card number, because there are none to expose.

Payment truth comes from the provider

A payment is marked paid or failed only when the payment provider confirms it — there is deliberately no “mark as paid” button anywhere in the system.

Access is role-based and scoped

• Team roles: admin, workshop and viewer — each user gets the least access their job needs.
• Renter and investor portals: each account sees only its own records, enforced server-side.
• Signing and payment links: single-purpose secure tokens that expire, not shared passwords.

Everything is attributable

Every operational action records the user who performed it. Contracts snapshot their terms, tax mode and fee rules at generation, so a signed document can never be silently altered by a later configuration change.

Defensive engineering

• All traffic is encrypted in transit (TLS).
• Webhook events are signature-verified before anything is recorded.
• Charges use idempotency keys — a retry can never double-charge a renter.
• State transitions are guarded — records can't jump to states the business rules forbid.
• Refunds are status-guarded so two processes can't refund the same money twice.

Reporting a vulnerability

Found something? Email cris@carz.lat with the details. We read every report, respond quickly, and credit researchers who report responsibly.