Last updated: 2 June 2026.
Security and tenant isolation are core to how Voyage is built. Here's an overview of the measures in place.
Tenant isolation
Every company's data lives in its own isolated database schema. Requests are scoped to the authenticated user's company, so one company can never see another's data.
Authentication
- Passwords are hashed with bcrypt; we never store them in plain text.
- Sessions use short-lived access tokens with rotating refresh tokens, and refresh tokens are stored hashed at rest.
- Accounts lock temporarily after repeated failed sign-in attempts.
Access control
Role-based access (employee, manager, administrator) plus least-privilege rules govern who can see what. Sensitive personal information (home address, vehicle, emergency contacts) is only visible under the employee's per-field consent, and only to their own manager and administrators.
Data protection
- Traffic is encrypted in transit (HTTPS).
- Personal-information access by a super-administrator is audit-logged.
- Data export and erasure are available to every user (POPIA).
Reporting an issue
If you believe you've found a security vulnerability, please contact us via the contact page so we can investigate promptly.