From how we issue seller credentials to how we audit our own team, security is woven into every layer of GarageRoute. Here's exactly what we do — and how to report an issue.
Plain English. No vague “industry-standard” hand-waving.
When you post a sale, we issue you a unique, cryptographically random URL like /manage/<128-bit-token>. That URL is the only credential required to manage your sale.
Treat it like a password. We strongly recommend bookmarking the page we email you at posting time. If you lose it, we can recover your listing under verified identity.
Every operator action — verifying a sale, viewing a private message, updating settings — is written to an immutable audit log with actor, action, target, metadata, and IP address. We use this both for incident response and for trust-and-safety reviews.
All traffic is TLS 1.2+. Database snapshots are encrypted at rest. Sensitive fields are hashed with industry-standard algorithms before storage. We rotate keys on a documented schedule.
Operator accounts have the minimum permissions needed for their role. Sensitive actions require step-up verification. Background checks are run on every team member with production access.
How to report an issue, where to track incidents, and what compliance certifications we're working toward.
Email security teamFound a security issue? Please email security@garageroute.com with reproduction steps. We respond within 24 hours and credit reporters in our public hall of fame (with permission).
Subscribe to /status for live operational status. We're committed to 99.9% availability and post incident reports within 48 hours.
We're working toward SOC 2 Type I in 2026. For enterprise partnership paperwork, email trust@garageroute.com.