What holds when someone gets in.What holds when someone gets in.

Tenant isolation

Every tenant-owned record carries a tenant id and is read through a global scope. A tenant id is never accepted from request input — it comes from the authenticated context only. Site-scoped roles filter further, so a supervisor pinned to one yard sees one yard.

Authorisation

Access is decided by policies per resource, not by role checks scattered through controllers. Field intake is additionally authorised by route assignment and geofence, and driver endpoints by ownership of the driver record.

Credentials

• Two-factor authentication is enforced for back-office roles.
• Auth tokens are compared in constant time.
• Personal data is stored with encrypted casts, so a database dump is not a customer list.
• Authentication failures are logged. Secrets and tokens never are.

Integrations

Every inbound webhook is signature-verified with a timing-safe comparison before the payload is touched. Raw payloads are stored alongside the parsed interpretation, so a dispute about what a bank or the taxman actually sent is settled by looking.

The audit trail

Dispatch, orders, requisitions and payments move through explicit state machines. A state changes only through a transition that validates the source state and writes an append-only event with the actor, the timestamp, the device and the location where one is available. Nothing is edited in place, and overrides carry the reason the supervisor typed.

Data protection

Pilot tenants sign a Data Processing Agreement before any data is loaded. What we collect and why is set out in the privacy notice.

Reporting a vulnerability

Email security@loadline.africa with enough detail to reproduce it. We will confirm receipt, keep you updated while we fix it, and credit you if you would like us to. Please do not test against a customer's live tenant.