Security at FK Command Center

You're trusting us with your fleet, your income, and your tax position. Here's exactly how we protect it — in plain language, no marketing fog.

Last updated: 2026-06-19 · Operated by Firstkontak Consultant Inc, San Diego, CA

How your data is protected

Encryption in transit and at rest

Every connection to FK Command Center is served over HTTPS/TLS, enforced with HSTS so browsers refuse to downgrade to an insecure connection. Your fleet, trip, maintenance, claim, and tax data is stored encrypted at rest in our managed Postgres database (Supabase). Uploaded files — invoices, receipts, photos — are stored in private, encrypted object storage.

Strict data isolation

Row-Level Security (RLS) is enabled on every table that holds your data, with a default-deny posture: a database key exposed to the browser can read nothing. All reads and writes flow through our application server, which authorizes each request against your specific license before returning a single byte. Uploaded files are served only through short-lived signed URLs scoped to your account, and every file path is ownership-checked on access.

Authentication built to resist attacks

• HttpOnly, signed session cookies — your session is an HMAC-SHA256-signed token that JavaScript can't read, marked Secure and SameSite=Lax to defeat cross-site request forgery.
• Constant-time credential checks — administrative and key comparisons use timing-safe equality, so attackers can't probe them character by character.
• Rate limiting on sign-in, key recovery, sign-up, and write operations to blunt brute-force and abuse.

Secure payments and integrations

Checkout and billing are handled by Stripe, a PCI-DSS Level 1 certified provider. Card data never reaches our servers. Incoming events from Stripe and our email provider are cryptographically signature-verified before we act on them, so forged webhooks are rejected.

Privacy by default

• We don't sell your data to anyone, and we don't run cross-web ad trackers (no Google Analytics, no Meta Pixel).
• Aggregated benchmarks are opt-in only, and the data that leaves your account is stripped of personal identifiers before it's ever counted.
• The Ask FK assistant sends only your current question's snapshot to the AI provider to answer it — with EIN and full VINs removed — and that snapshot is not retained or used to train any model.
• Error monitoring is configured to scrub credentials, cookies, and tokens before any diagnostic leaves our servers.

How we keep it secure over time

• Recurring security reviews of authentication, access control, injection surfaces, and secret handling, documented internally.
• Automated dependency scanning — our build pipeline audits third-party packages for known vulnerabilities and flags risky updates automatically.
• Static analysis and secret scanning in continuous integration, so vulnerable patterns and accidentally-committed secrets are caught before they ship.
• Hardened HTTP headers — Content-Security-Policy, HSTS, anti-clickjacking, and a locked-down cross-origin policy on every response.
• A written incident-response runbook with predefined containment steps and customer-communication templates.

Your controls

Sub-processors

A short, vetted list of providers helps run the product. Each is contractually bound not to use your data for their own purposes.

Responsible disclosure

Found a security issue? We want to hear from you, and we won't pursue good-faith researchers who follow this policy. Please email security@firstkontakconsulting.com with steps to reproduce, and give us a reasonable window to fix it before any public disclosure. Avoid privacy violations, data destruction, and service degradation while testing.

See also our Privacy Policy and Terms of Service.