Security & Trust

• No API keys or secrets are shipped to your browser.
• Only a public, restricted database key is used client-side.
• Private keys live in server-side secret storage and are read only inside handlers.
• The codebase is scanned for accidentally committed credentials.

• Row-level security on every table: your records are readable only by you.
• Roles are held in a separate permissions table, never on your profile.
• Every sensitive server action re-checks your identity on the server.
• Order, plan and status changes are locked to the owner or to authorised staff.

• Passwordless sign-in with one-time codes, plus Apple Sign In.
• Any stored credentials are salted and hashed — never held in plain text.
• Sessions use Secure, HttpOnly, SameSite cookies with automatic refresh.
• Sign-in attempts are rate limited, with automated bot protection on our forms.

• Encrypted in transit (TLS/HTTPS enforced) and encrypted at rest.
• Card details are handled by Stripe — we never store them.
• Database queries are parameterised, so injection attacks don't apply.
• All input is validated on the server; responses return only the fields needed.
• User-supplied content is escaped before it is rendered.

• Security headers on every response: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
• HTTP requests are redirected to HTTPS.
• Dependencies are scanned for known vulnerabilities and patched.
• File uploads are not accepted from the public site.

• "Centrico", "Centrico Mobile", the Centrico logo and the Centro character are trademarks of Centrico Mobile Ltd. All site copy, artwork and mascot illustrations are our own and may not be reused without permission.
• Typeface: Manrope, served by Google Fonts under the SIL Open Font License 1.1.
• Icons: Lucide, used under the ISC licence.
• Map data: © OpenStreetMap contributors, used under the Open Database License; map rendering by Leaflet (BSD 2-Clause).
• Any other company or product names mentioned are the trademarks of their respective owners and are used only for identification and comparison.

Responsible disclosure is welcome. Email help@centricomobile.com with the details and we'll acknowledge within 2 working days.