Role-based access, identity verification, environment hygiene.
Customer, Driver, Freight, Admin — every API call is gated by the user's claim set. No portal mounts without an authenticated session.
ID + license + face-match + background check + signed agreement. Drivers can't accept jobs without all five steps complete.
Secrets never ship to the client. All keys live in Vercel encrypted env — separate scopes for preview vs production.
All POSTs require CSRF + auth. Stripe webhooks signature-verified. WiPay callbacks IP-allowlisted.