What protects your account, your card and your data

With two factors and short sessions. Otopair’s internal consoles, where the team reviews shop applications and licence documents, are separate from the driver and shop sign-in. Staff log in with their email and a six-digit code from an authenticator app; the session that creates expires after 8 hours and then requires a fresh code.

• Generic errors. A wrong email and a wrong code produce the same message, so the login screen cannot be used to discover which emails belong to staff.
• Failed attempts are logged. Every failed login is written to the audit log alongside successful logins and logouts.
• Roles limit what a session can do. Managing shops, money, data and staff accounts are separate capabilities; a session only has the ones its role grants.

By Stripe, end to end. Your card is entered in Stripe’s own payment sheet inside the app; the number never reaches Otopair’s servers. Otopair stores the card brand and the last four digits, for your receipt, and Stripe’s identifiers for the hold and the charge. Apple Pay and Google Pay go through the same path.

Shops are paid through Stripe Connect Express accounts. Stripe, not Otopair, verifies each shop’s business identity and payout bank details; Otopair stores only Stripe’s report of whether charges and payouts are enabled and whether anything is outstanding. A shop cannot take bookings until that report is clean. How the hold, the capture and refunds work is on trust and safety.

Every message that arrives from a partner service is checked for a valid signature before it is trusted. Stripe payment and payout events, Clerk account events and delivery events from the SMS provider are each verified against that provider’s signing key, and unsigned or mis-signed messages are rejected; the SMS provider’s events additionally carry a timestamp and are refused if they are more than five minutes old.

• API keys are stored as hashes. A key for the vehicle-data API is shown once, when it is created. Otopair keeps only its SHA-256 hash and a short display prefix, so a copy of the database does not contain a usable key.
• Keys are scoped and rate-limited. Each key carries the scopes it may use, such as maintenance data or labor data, and its own requests-per-minute limit. Every request is metered, and a key can be revoked at any time.
• Shop invite links are stored the same way. The private link an approved shop owner receives is single-use and expires in 7 days; Otopair stores only its SHA-256 hash.

Staff actions that change who is on the platform and what they can do. The audit log records: staff logins, logouts and failed logins; shop applications approved or declined; licence documents marked verified or rejected, with the reason; shops activated or deactivated; the Verified badge granted or removed, with the reason; edits to a shop’s details; changes to the vehicle health score weights; staff accounts added, removed or changed; and API keys created or revoked.

Each entry carries who acted, what changed, the reason where one is required, and when. Reading the log requires a staff session.

In transit, everything travels over TLS: between the app or website and Otopair’s backend, and between the backend and Stripe, Clerk and the other providers it talks to. In storage, your data lives with Otopair’s cloud database provider; the app and the website never talk to the database directly, only to Otopair’s backend functions.

Access inside Otopair is limited to the people who need it for their role, and staff reads of the audit log and of shop records go through the staff session described above. Uploaded files such as licence documents are stored as files behind long, unguessable links rather than in a browsable folder; a link is issued through the shop owner’s or a staff member’s own session, and because anyone holding one can open the file, they are never published.

Because the link is the key. When a payment settles, the receipt email contains a private link that opens your itemised receipt and its PDF without a sign-in, so that walk-in customers without an Otopair account can read theirs. The link carries a long random token; anyone holding it can open that receipt. Treat the link like the receipt itself: do not forward the email, and if you have an account, the same receipt is always available from the booking in the app.

Email support@otopair.com with “Security” in the subject line. Include what you found, where, and how to reproduce it, and keep any proof-of-concept to your own accounts and data. Otopair acknowledges every report, fixes confirmed issues, and credits the reporter publicly if they would like to be named. There is no formal bounty programme yet.

A security page is only useful if it is exact about its edges. Three things Otopair does not claim today:

• No third-party attestations yet. Otopair has not published a SOC 2, ISO 27001 or PCI report. Card handling is delegated to Stripe, which holds its own certifications; Otopair’s own attestations are future work.
• Not every internal tool enforces the same session checks yet. The staff login described above is in place, and the audit log records staff actions, but bringing every internal function under the same server-side session check is still in progress. Until it is done this page does not say “every admin action requires a verified session”.
• Account deletion is a request, not an automated purge. Deleting your account flags it for deletion and closes it; removing your profile and vehicle details is done by the team rather than on a fixed automated schedule. The privacy policy explains what is kept and why.

When any of these changes, this page changes with it and the date at the top moves.

Does Otopair store my card number?

No. Card details are entered directly with Stripe, from the app's payment sheet, and never pass through Otopair's servers. Otopair stores the card brand and the last four digits so your receipt can show which card was used, plus Stripe's own identifiers for the payment.

Is Otopair SOC 2 or PCI certified?

Otopair has not published a SOC 2, ISO 27001 or PCI attestation. Card handling is delegated to Stripe, which holds its own PCI certification; Otopair never touches card numbers. This page lists what is built rather than claiming a certificate that does not exist yet.

Can Otopair staff see my password?

No. Sign-in is handled by Clerk, a dedicated authentication provider. Otopair receives a signed token that says who you are; it never receives or stores your password.

What happens if I delete my account?

Today deletion is a request. Your account is flagged for deletion and closed. Removing your profile and vehicle details, and detaching your identity from the transaction records that tax and payment rules require Otopair to keep, is done by the team rather than on an automated schedule. The privacy policy explains how to make the request.

How do I report a security issue?

Email support@otopair.com with 'Security' in the subject line and as much detail as you can share safely. Otopair acknowledges the report, fixes confirmed issues, and credits the reporter if they would like to be named. Please do not test against other people's accounts or data.