Security

Last updated: 15 October 2026

FuelXpress holds sales, stock, cash and credit records, so we treat it that way. This page lists what the product does today.

Your data stays yours

  • Companies are kept apart. Every request is limited to the signed-in user's own company, in the database layer as well as the screens. Automated tests with two companies check that one cannot read or change the other's records, and they run on every release.
  • You can take it with you. A company administrator can download a ZIP of the company's data at any time.
  • You can delete it. Deleting your account or company starts a 30 day retention period, after which the data is permanently erased.

Sign-in and access

  • Passwords are never stored in readable form: each is hashed with its own random salt.
  • Two-factor sign-in with an authenticator app is available to every user.
  • Sessions can be ended. Users see where they are signed in and can sign a device out; the device stops working immediately.
  • Roles limit what people can do. Owners, station managers and staff see only what their role allows.
  • Guessing is slowed down. Sign-in and sign-up attempts are rate limited.
  • The watch app is read-only. Its sign-in token can view figures and alerts but cannot change anything, and it stops working when the phone session ends.

Accountability

  • Activity history. Changes to prices, users and permissions, billing, stock and closures are recorded with who made them and when. Passwords and secrets are never written to it.
  • Deletions leave a trace. Deleted sales and records add a negative entry, so a deletion cannot quietly hide a figure.

Protecting the platform

  • Encrypted in transit. The apps, the web app and the API use HTTPS only.
  • Secrets are encrypted. Stored keys and passwords (for example the email account the system sends from) are encrypted in the database, and production secrets are kept outside the source code.
  • Releases are tested. Every change runs the automated tests before it is deployed.

Last reviewed: October 2026.

Found a problem? Write to support@fuelxpress.pk and we will respond promptly. See also our Privacy policy.

Contact

VTOXI, G-15/4, Islamabad, Pakistan
Email: support@fuelxpress.pk · Phone: +92 335 3232352