Skip to main content
The c.technology platform implements a comprehensive security model that governs how organizations, users, and vehicles interact within the system. This security architecture ensures appropriate data access, maintains clear audit trails, and supports complex multi-tenant scenarios while preserving data isolation and privacy.

​
Security architecture overview

The platform’s security model is built on three fundamental entity types that work together to provide granular access control:
  1. Organizations - Multi-tenant containers that group users and vehicles.
  2. Users - Individual accounts with authentication and authorization.
  3. Vehicles - IoT-enabled assets with sensor data and operational information.
These entities are connected through a role-based access control (RBAC) system that determines what actions users can perform on vehicles, either directly or through their organizational memberships.

​
Core security relationships

The platform implements several key relationship models that define access patterns and data sharing boundaries:

​
Organization - vehicle relationships

Organizations can be associated with vehicles through the OrganizationVehicle model, which defines the nature of the organization’s relationship with each vehicle. These relationships include OEMs that manufacture vehicles, dealer organizations that sell or distribute vehicles, service provider organizations that maintain or repair vehicles, and fleet owner organizations that operate multiple vehicles commercially. Each organization-vehicle relationship includes a specific role that determines what actions the organization and its members can perform on that vehicle. 
# Example organization-vehicle relationship
{
  "organization": "com.bostonwhaler",
  "vehicle": "boat-12345", 
  "role": "VEHICLE_MANUFACTURER"
}

​
User - vehicle relationships

Users can have direct access to vehicles through the UserVehicleAccess model, which assigns specific roles for individual user-vehicle combinations. This mechanism supports scenarios such as vehicle ownership where users register and own their personal vehicles, family sharing where vehicle owners grant access to family members, professional services where mechanics or inspectors need temporary access, and emergency access for support or rescue scenarios. The direct access model takes precedence over organizational access, allowing fine-grained control over individual permissions.

​
Organization - user relationships

Users become members of organizations through the OrganizationMember model, which defines their role within that organization. Organization membership provides inherited vehicle access based on the organization’s vehicle relationships, administrative capabilities for managing the organization’s vehicles and members, billing and subscription management responsibilities, and custom role definitions specific to the organization’s operational needs.

​
Multi-tenant data isolation

The platform ensures logical data isolation between different organizational contexts while enabling controlled data sharing when appropriate:

​
Tenant boundaries

Each organization operates within its own logical tenant space, with clear boundaries around user data where organization members only see users within their organization context, vehicle data with access limited to vehicles the organization has relationships with, configuration data with custom settings and preferences isolated per organization, and billing data with financial information completely separated by organization.

​
Cross-tenant scenarios

The platform supports controlled cross-tenant interactions for legitimate business scenarios including multi-OEM vehicles where vehicles may have relationships with multiple manufacturers, service provider access where maintenance organizations need temporary vehicle access, data sharing agreements between partner organizations, and white-label deployments where one organization provides services to others.

​
Primary organization relationships

Users and vehicles can have primary organization relationships that determine default contexts and billing responsibilities. User primary organization influences UI branding, default features, and support routing, while vehicle primary organization determines billing responsibility and primary management authority, and manufacturing organization affects device configuration, firmware updates, and technical support.

​
Access control mechanisms

The platform implements several layers of access control to ensure appropriate data access. See the permission section for detailed information.

​
Authentication and session management

Authentication is handled through secure token-based mechanisms. Tokens can be retrieved by logging in with email and password, using OAuth or SAML for third-party integrations, or through API keys for programmatic access.
⌘I