Tenant isolation
Customer, vehicle, job and document records are associated with one garage ID. Linked-record writes are checked against that garage and protected by database integrity rules.
SECURITY
Built to keep garage workspaces separated.
Albacino Garage uses authenticated server-side sessions, tenant-scoped database access, database-level tenant integrity checks, audit records and payment verification on the server.
Authentication
Passwords are salted and hashed with PBKDF2-HMAC-SHA256. Production sessions use HttpOnly, Secure, SameSite cookies and expire automatically.
Payments
SumUp collects card details directly. Payment success is re-checked from the backend before access or invoices are marked paid.
Browser protection
Production responses apply security headers including HSTS, CSP, frame protection, permissions policy and no-store caching for API responses.
Security reports can be sent to info@albacino.co.uk.