Enterprise Security & Access

The moment a rental business passes a certain size, software gets judged by a second audience: the people responsible for security. Their first questions are always about identity.

Renttix answers them properly. Single sign-on connects the platform to your identity provider, so joiners, leavers, and password policy are governed where your IT team already governs them — with an admin portal link for configuring the connection without support tickets.

For teams without an identity provider, passkeys bring phishing-resistant sign-in to any account: a fingerprint or face unlock instead of a password that can be reused, guessed, or leaked. Two-factor authentication adds a second check for accounts that keep passwords.

Team onboarding is controlled too — invite links bring new users in with the right role from the first minute, and links can be rotated the moment one escapes captivity.

Most software permissions are decorative — a hidden menu item and an exposed API. Renttix permissions are enforced where it counts: on the server, on every request.

Access is role-based, built from a registry of fine-grained permission keys covering every module — orders, finance, dispatch, workshop, warehouse, and the rest. Roles bundle the keys; users carry the roles; the backend checks the keys. A user without financial permissions gets no financial data, whichever door they knock on — the interface, the API, or the AI assistant.

Sub-users let you give counter staff, drivers, and accountants exactly the slice they need, and nothing else.

High-risk actions — overrides, deletions, configuration changes — carry elevated permission requirements, so the dangerous levers need deliberate granting rather than defaulting to everyone.

Access control tells you who may act. The audit trail tells you who did.

Renttix records changes to sensitive records automatically — who changed what, when, and from what to what — with sensitive values redacted from the log itself, because an audit trail that leaks passwords is worse than none.

Staff changes, permission grants, financial adjustments, overrides, and configuration edits all leave entries. When something looks wrong three weeks later, the sequence of events is a query, not an interrogation.

Combined with API request logs and webhook delivery records, the platform's answer to 'what happened?' is consistently: it is written down. That is the posture larger customers, insurers, and auditors increasingly demand from operational software — and the posture that lets your business pass their questionnaires without a special project.