Locked down like the backstage door

Security pillars

• Single sign-on with Keycloak

  Every workspace authenticates through Keycloak using OpenID Connect. ShowTime never stores passwords, MFA policy lives with your identity provider, and offboarding a user happens in one place.

• Isolated company workspaces

  Each company runs on its own subdomain, such as rtg.showtimetms.com, with its own realm, sessions and data. One tour company's records are never a filter away from another's.

• Server-enforced roles

  Owner, dispatcher, accounting, safety, sales and driver roles are checked on the server for every request, not just hidden in the interface.

• Sensitive fields stay hidden

  Pay rates, tax forms and owner-operator settlements are stripped from responses for roles that can't view them, including inside Standby.

• Complete audit trail

  Changes to movements, rates, documents and users are logged with who, what and when, so disputes are settled with a record instead of memory.

• Encrypted in transit

  All traffic is served over HTTPS with strict transport security, and shareable tracking links are scoped to a single movement and expire when the job ends.