Roles and access
Granular permissions per module: warehouse, work orders, accounting, settings. Warehouse staff can't see finances, accountants can't edit stock.
Secure inventory software for multi-user warehouses
Built for salvage yards and shops: roles, audit trail, and tenant isolation — foundation of the architecture, not an add-on.
RBAC
Roles and per-module permissions
100%
Company data isolation
Realtime
Activity log
Server
Checks in every API route
Security foundation
Access control, audit trails, and tenant isolation are built into the product — not bolted on later.
Activity log
Every meaningful change is recorded with the employee, role, and timestamp. Managers see the full picture in Mission Control, no exports needed.
Company isolation
Multi-tenant architecture: each organization's data is isolated at the level of Firestore Security Rules and server-side checks.
Operation audits
A trail for stock, ledger entries, permissions, and documents: a transparent "who · what · when" chain, no "go ask Pete".
Defense in layers
Authentication, data rules, API checks, and document tokens each close a different attack surface.
Authentication
Firebase Auth: email, Apple ID. Sessions are managed by the platform.
Data rules
Firestore rules restrict reads and writes by companyId and user role.
API routes
Server-side access checks before any operation on orders, stock, or finances.
Documents
PDFs and printing use one-time render tokens, with no public links to data.
Live audit trail
Managers see who changed stock, closed a work order, or changed permissions — without exporting spreadsheets.
Closed work order WO-2026-0142
Work OrdersWrote off G4KC-88421 from shelf A-12
WarehouseUpdated mileage on a vehicle record
FleetGranted the accounting role access to the "Operations" module
TeamDesign principles
Least privilege by default
A role only grants access to the modules it needs. Expanding permissions goes through the owner or an admin, and is logged.
Transparency for managers
The owner sees who changed a stock count, closed a work order, or granted permissions, in the realtime activity log.
A production-ready stack
Firebase Authentication, Firestore Security Rules, and a server-only API that checks companyId and role on every request.
What you get out of the box
Security defaults that match how a multi-user auto business actually operates.
- Data access only after authentication
- Every request is tied to a companyId
- RBAC is enforced on the server, not just in the UI
- A log of significant actions for managers
- Tenant data isolation in Firestore rules