Security at Lot Helix
What protects your lot, your vehicles and your customers’ information.
The short version
- Each company’s data lives in its own walled-off workspace. Nobody outside your company can see it, and neither can other Lot Helix customers.
- Everything is encrypted on the wire and on disk, backed up daily, and yours to export any time.
- Card payments go through Stripe. Lot Helix never sees or stores a card number.
Where your data lives
Lot Helix runs on Supabase, a managed Postgres database and sign-in service hosted on Amazon Web Services in the United States (us-east-1). The website and app are served by Cloudflare. Vehicle photos and release paperwork are kept in private storage on the same platform. We do not run our own servers, so there is no office computer holding customer data.
Keeping companies apart
Every row in the database is tagged with the company it belongs to, and the database itself enforces that only that company’s signed-in owners and drivers can read or change it (Postgres row-level security). That check happens on the server for every request, not just in the app, so one customer cannot reach another’s yard even by tampering with the app.
Encryption
All traffic between your phones, the website and our servers uses HTTPS (TLS), and the site tells browsers to never use plain HTTP. Data at rest, including backups, is encrypted on disk by the hosting platform. Photos and documents open through private links that expire after an hour.
Sign-in and access
Owners sign in with an email address and password. Passwords are stored only as a salted hash, and new passwords are checked against the Have I Been Pwned list of leaked passwords so a known-compromised password cannot be used. Drivers and staff use access codes of at least 10 letters and numbers, each with its own level: view only, move and check in, or full. Sign-in attempts are rate-limited by phone and network to stop code guessing. The owner can change or turn off any code at once from the app, and removing a person ends their access immediately. Public status links are random 24-character tokens that show only what you chose to share and stop working when they expire or you turn them off.
Payments
Subscriptions are billed by Stripe through Stripe Checkout and the Stripe billing portal. Card numbers are entered on Stripe’s pages and never pass through Lot Helix. We store only the Stripe customer and subscription IDs needed to know what your account is paying for.
Backups and your data
The database is backed up daily, and backups are kept for 7 days. You can export every vehicle as a spreadsheet and download a full copy of your company’s data from the app at any time, and invoices export in the QuickBooks format. When an account closes, its data is deleted on the schedule in the privacy policy.
What we do not do
We do not sell or share customer data, run ads, or use your vehicles or customers to train anything. The only outside services that ever see your data are the ones that run the product: Supabase (database and sign-in), Cloudflare (website, bot check on forms), Stripe (billing), Resend (email) and, only when you tap the photo button to read a VIN, the AI service that reads that one photo. Each is listed in the privacy policy.
Who is behind it
Lot Helix is built and operated by Thrash Digital LLC in Alexandria, Louisiana, a single-owner company. Only the owner has administrative access to the production database and hosting accounts, and those accounts use two-step sign-in. Changes to the app go through version control before they are published.
Vendor reviews and questionnaires
Lot Helix does not currently hold a SOC 2 report or ISO 27001 certification. If your organization needs a security questionnaire completed or a data-processing agreement signed, email [email protected] and we will answer it directly. Found a security problem? Please report it to the same address; see our security.txt.
Last updated October 15, 2026