Security & Trust

• Email and password sign-in, with passwords managed by the hosting platform's authentication service — the application never stores raw passwords.
• Self-service password reset by email link.
• New accounts request a role and remain in a pending state until an administrator approves them.
• Sessions are issued as short-lived tokens that are refreshed automatically and cleared on sign-out.

• Roles are stored in a dedicated roles table, separate from user profiles, and are only changeable by an administrator.
• Row-level security is enabled on every operational table, so access rules are enforced by the database rather than only by the interface.
• Customers can read only their own bookings, trips, documents, invoices, and messages; drivers can read only the trips assigned to them.
• Privileged operations (creating users, changing roles, resetting passwords) run server-side and verify the caller is an administrator before executing.

• Trip documents are held in a private storage bucket that is not publicly listable or readable.
• Files are delivered through short-lived signed links generated only for users authorised to view that trip.
• System-generated documents such as GST invoices are rendered server-side into clean PDFs with all user-supplied fields escaped.

The application is hosted on Lovable Cloud, which provides the managed database, authentication, and file storage. Traffic is served over HTTPS, and data is encrypted in transit and at rest by the hosting platform. Backups and infrastructure patching are handled at the platform layer.

• The hosting platform secures the underlying infrastructure, database, storage, and transport encryption.
• Anup Transport Company manages user accounts and roles, approves access, and decides what operational data is recorded and how long it is kept.
• Users keep their credentials confidential, use the account assigned to them, and report anything suspicious promptly.

If you believe you have found a security problem, please contact Anup Transport Company using the details on the Support page rather than disclosing it publicly. Include the steps to reproduce and the time you observed the issue. Reports are acknowledged and investigated.

Anup Transport Company does not currently claim any external security certification for this platform. Any compliance or certification statement will only be published here once the company has completed and can evidence it.