Security

Access rules are enforced in the database itself, not only in the app. Every request runs as the signed-in member, so private cars and sensitive fields — costs, documents, VIN and plate — are only reachable by their owner.

Invoices and paperwork are kept in private storage, separate from photos. They have no public address and are only opened through signed links issued to the owner, which expire after an hour.

• In transit: all traffic to Elferlog is encrypted with HTTPS.
• At rest: the database, backups and file storage are encrypted.

You sign in with email and password or with Google or Apple. Passwords are stored only as salted hashes, never in readable form. Account deletion requires you to be signed in.

Found something that looks wrong? Email karsten@wesentlich.no with the details and steps to reproduce. We will confirm we have received it and keep you updated while we fix it. Please give us a chance to fix it before sharing it publicly.