The part most software hides. We lead with it.
Masilar's tagline is a promise about data: what you see is what the database enforces. Here is exactly how your shop's data is protected — no vague badges.
Tenant isolation, enforced by the database
Every row of shop data carries your organization's identity, and PostgreSQL row-level security policies enforce it on every single table. Your data is invisible to other shops at the database layer — not just hidden by the interface.
A hash-chained audit log
Every sensitive platform action — lifecycle changes, payments, plan changes — is written to an append-only audit log where each entry cryptographically chains to the previous one. Inserting, deleting or reordering history is detectable.
Server-side subscription enforcement
Access control lives on the server and in the database, not in the browser. Subscription state is checked on every request, and even direct database write paths respect it — a paused account is read-only at the PostgreSQL level.
Money as integers, verified twice
All money is stored as integer centimes — no floating-point drift. Money-moving operations are database functions proven with boundary tests before they ship, and protected against double-submission server-side.
Private files, signed access
Vehicle photos, inspection photos and patterns live in private storage buckets, served through short-lived signed URLs scoped to your organization.
Encrypted third-party credentials
Courier API credentials are encrypted at rest with AES-256-GCM and readable only by the server — never by browser clients.
What we don't claim: we are not (yet) SOC 2 or ISO 27001 certified, and our AI features are in beta. When that changes, you'll read it here first.