Security

Security is infrastructure, not a feature

Roukit handles deliveries, payments, and the personal data of customers and captains. Security is built into every layer of the platform — from data isolation to payment processing to API design.

Data Isolation & Privacy

Customer, driver, and business data is isolated at the database level using PostgreSQL Row-Level Security (RLS) policies. Access is enforced by the database engine itself, not just application logic, so data is only ever visible to those authorized to see it.

Row-Level Security enforced at the PostgreSQL level
Strict separation between customer, driver, and business data
Access context validated on every query
Least-privilege access to personal and location data

Encryption

All data is encrypted both at rest and in transit. Database storage uses AES-256 encryption. All connections between services use TLS 1.2 or higher. API keys, payment credentials, and sensitive configuration are stored in environment-level secrets, never in code.

AES-256 encryption at rest for all stored data
TLS 1.2+ for all data in transit
HTTPS enforced across all endpoints
Secrets managed via environment variables, never committed to code

Authentication & Access Control

Sign-in is handled by Supabase Auth using one-time passcodes (OTP) sent to a phone number or email — phone is the primary method, so there are no passwords to leak. Sessions use secure, HTTP-only cookies, and role-based access control separates customer, driver, and ops permissions.

Phone & email one-time passcodes (OTP) — no passwords stored
Supabase Auth with secure session management
Role-based access control (RBAC) for customers, drivers, and ops
HTTP-only, secure session cookies
Automatic session expiration and refresh

Payment Security

Roukit is cash-on-delivery first, with Egyptian digital wallets (InstaPay, Vodafone Cash, Meeza, Fawry) processed through a payment service provider. Card and wallet credentials are handled by the PSP — Roukit never stores them. Webhook signatures are verified on every callback.

Cash on delivery by default
Digital wallets processed via a payment service provider
No card or wallet credentials stored on Roukit servers
Amounts handled server-side in minor units (piastres)
Webhook signature verification on all callbacks

Infrastructure Security

The platform runs on AWS App Runner — a managed container service with automatic scaling, load balancing, and managed TLS — protected by AWS Shield Standard against DDoS. Files and media live in Supabase Storage behind access-scoped URLs. The database is managed Supabase PostgreSQL with automated backups and point-in-time recovery.

AWS App Runner managed containers with AWS Shield Standard DDoS protection
Supabase Storage for files and media, with access-scoped URLs
Automated database backups with point-in-time recovery
Infrastructure monitoring and alerting
Automatic SSL certificate management

API Security

All API endpoints validate input, sanitize data, and enforce rate limits. CORS policies restrict cross-origin requests. API routes use server-side authentication checks before processing any request. Structured error responses never leak internal details.

Input validation and sanitization on all endpoints
Rate limiting to prevent abuse
CORS policies restricting cross-origin access
Server-side authentication on all protected routes
Structured error responses without internal detail leakage

Data protection & your privacy

We keep data collection minimal and put you in control of your information.

Your data, your control

We collect only what a delivery needs. You can ask for a copy of your data or have it deleted, and we practise data minimization across the product.

Encrypted & backed up

Data is encrypted in transit and at rest, with automated database backups and point-in-time recovery.

Least-privilege access

Internal access to production systems is granted only when needed and removed when it isn't.

Audit trail

Sign-ins and sensitive operations actions are logged so issues can be investigated.

Secure development practices

Security starts in the development process, not after deployment.

Secure development

Strict TypeScript across the entire codebase catches type-related vulnerabilities at compile time. Dependencies are pinned to exact versions and reviewed before adoption.

Dependency management

Automated vulnerability scanning on all dependencies. Security patches are applied within 48 hours of disclosure for critical vulnerabilities.

Code review

All code changes go through review before deployment. Security-sensitive changes (auth, payments, data access) receive additional scrutiny.

Environment separation

Development, staging, and production environments are fully separated. Production credentials are never used in development or testing.

Responsible disclosure

We take security vulnerabilities seriously.

If you believe you've found a security vulnerability in Roukit, we encourage you to report it responsibly. Please email security@roukit.co with details of the vulnerability.

When reporting, please include:

  • A description of the vulnerability and its potential impact
  • Steps to reproduce the issue
  • Any relevant screenshots or proof of concept

We commit to acknowledging reports within 48 hours and providing an initial assessment within 5 business days. We ask that you give us reasonable time to address the issue before any public disclosure.

Questions about security?

If you have specific security questions or need additional information for your compliance review, reach out to our team.

Contact Ussecurity@roukit.co