Product
Security & Access Control
Enterprise-grade security built in from the start: authentication, authorisation, 2FA, SSO, and a full audit trail.
200+
Named permissions
TOTP
2FA built-in
SAML
2.0 SSO
Argon2
Password hashing
Security is not an afterthought at Transportial. JWT-based authentication with short-lived tokens, two-factor authentication, 200+ named permissions, SAML 2.0 SSO, Argon2 password hashing, and per-API-key rate limiting are all standard, not add-ons.
Key highlights
- JWT authentication: Short-lived access tokens (minutes) with long-lived refresh tokens (days) minimise the window of exposure if a token is compromised. Token rotation is automatic.
- Two-Factor Authentication (TOTP): All users can enable 2FA using any TOTP app (Google Authenticator, Authy, etc.). Setup uses a QR code and generates recovery codes.
- Role-Based Access Control (RBAC): Five built-in roles (USER, CHAUFFEUR, SUPPORT, ADMIN, SUPER_ADMIN) provide a sensible default structure.
- 200+ named permissions: Fine-grained permissions like read:vehicle-description and create:trip let you control exactly what each role or user can do.
- SAML 2.0 SSO: Enterprise customers integrate their own IdP (Azure AD, Okta, or any SAML 2.0 provider) for SSO with automatic user provisioning.
- Argon2 password hashing: Passwords are hashed using Argon2id, the winner of the Password Hashing Competition, providing resistance against GPU-based brute-force attacks.
- Per-API-key rate limiting: Every API key has its own configurable rate limit. Burst traffic from a misbehaving integration is contained without affecting other consumers.
- Error tracking & request logging: All API requests are logged. Errors are reported to Sentry in real time with full stack traces and request context.
How it works
Authenticate with short-lived tokens
Users sign in and receive a short-lived JWT access token with automatic rotation against a longer-lived refresh token, so a leaked token is useful for minutes, not months. Authentication is stateless and validated before requests reach business logic.
Add a second factor
Any user can enable TOTP two-factor authentication with a standard authenticator app. Setup is a QR code, and recovery codes cover a lost device.
Assign roles, then refine
Five built-in roles give a sensible default structure. From there, more than 200 named permissions, such as create:trip or approve:invoice, let you tailor exactly what each role or individual user can do.
Scope every integration
API keys are created per consuming system, each with its own scopes and rate limit. Revoking one integration never touches another.
Keep the record
All requests are logged, errors are tracked in real time with full context, and every data change lands in the immutable audit trail.
Technical details
Authentication is stateless, with no session storage. Access tokens are validated at the API gateway level before requests reach business logic. The permission check is performed per-endpoint via a declarative annotation system.
Frequently asked questions
Does Transportial support two-factor authentication?
Yes, for every user. 2FA uses standard TOTP apps such as Google Authenticator or Authy, is set up with a QR code, and generates recovery codes for account recovery. It is included, not a paid add-on.
Can we use our own identity provider?
Yes. Transportial supports SAML 2.0 single sign-on with Azure AD, Okta, Google Workspace or any compatible IdP. Users are provisioned automatically on first sign-in, and access control stays with your IT department.
How fine-grained is access control?
Beyond the five built-in roles, more than 200 named permissions control individual actions such as creating trips, reading vehicle details or approving invoices. Permissions can be tailored per role or per individual user.
How are passwords stored?
Passwords are hashed with Argon2id, the winner of the Password Hashing Competition, chosen for its resistance to GPU-based brute-force attacks. Plaintext passwords are never stored.
What happens if an API key is compromised?
Keys are scoped per consuming system with individual rate limits, so a compromised key is revoked on its own without affecting other integrations. Short-lived access tokens and request logging limit and expose any window of misuse.
Is there an audit trail for compliance?
Yes. Every change to every entity is written to an append-only audit log with the user, timestamp and previous value, and all API requests are logged. This supports both compliance requirements and day-to-day dispute resolution.
View all features
Transport Order ManagementInteractive Plan BoardAI-Powered Trip OptimisationFleet & Resource Management3D Load PlanningOpenMove Driver AppReal-Time Vehicle TrackingMulti-Modal RoutingPricing EngineInvoicing & Financial ManagementMessage AutomationsDocument Management & GenerationIntegrated Email InboxIn-App ChatCustomer & Business PortalIntegration FrameworkReporting & InsightsMulti-Tenancy & White-LabelSecurity & Access Control
Ready to put this to work?
Start free with full platform access, or talk to our team about your specific operation.