Security

Last updated: August 20, 2026

Protecting dealership data is a design decision in AutoDeck, not an afterthought bolted on.

Tenant isolation at the database level

Every dealership's data is isolated using PostgreSQL Row-Level Security (RLS) policies — meaning access control is enforced by the database itself on every query, not just checked in the application's interface. One dealership cannot see another's inventory, customers, or financial records, even in the event of a bug in the application layer above it.

Encrypted connections

All traffic between your browser and AutoDeck is encrypted over HTTPS.

Authentication

Login and session management are handled by Supabase Auth, an established authentication provider — passwords are never stored in plain text.

Backups

Beyond our database provider's own protections, we run an independent, automated backup pipeline: the database is backed up on a regular schedule (at least every 6 hours) to encrypted off-site storage, separate from our primary hosting provider — so a problem with one doesn't take out the other.

Infrastructure

AutoDeck runs on managed infrastructure rather than self-hosted servers: Supabase for the database and file storage, Vercel for application hosting. Both are established providers responsible for the security of the underlying infrastructure.

No payment card data

AutoDeck does not process or store payment card details. Subscriptions are currently billed by direct bank transfer, so there's no card data in our systems to be exposed in the first place.

Reporting a security issue

If you believe you've found a security issue, please report it privately to support@autodeck.lk with enough detail for us to investigate. We'll respond and keep you updated as we look into it.