Security
This document is available in English and Hebrew. If there is any difference between them, the English version governs.
Your fleet data is part of how you run your business. This page explains, in plain words, how we protect it.
Where your data lives
4X4Ops runs on Google Cloud (Firebase) in the EU data region. Data is encrypted in transit with HTTPS and encrypted at rest by Google.
Every company is isolated
Each company's data is stored separately. Our server checks every read and write: only members of your company can see its data, and only according to their role.
Roles and permissions
- Owner / Manager – everything, including team management.
- Mechanic – services, repairs, inventory and technician calls; cannot add or delete vehicles.
- Guide / Driver – trail panel and fault reports; view-only for the rest.
These rules are enforced on the server, so they cannot be bypassed by modifying the app.
Sign-in and accounts
Each person signs in with their own email and password (minimum 8 characters). Passwords are never stored in plain text. Team invitations are single-use links that expire after 7 days. Deleting an account or a company requires entering the password again.
Payments
Payments are handled by Paddle.com, a PCI-compliant Merchant of Record. 4X4Ops never sees or stores card numbers. Payment notifications from Paddle are verified with cryptographic signatures before your plan changes.
Your control
Every change is recorded with who made it and when. Owners and managers can export all company data at any time, and the owner can delete the company and all its data.
Report a security issue
If you believe you found a vulnerability, please write to support@4x4ops.com. We will respond promptly and appreciate responsible disclosure.