A moving company needs one connected operating picture, but not every employee needs access to every detail. Owners review company performance. Salespeople manage leads and estimates. Dispatchers coordinate jobs, crews, and trucks. Crew members need the information required to complete assigned work.
Role-based access keeps the platform useful without making sensitive information broadly available. For software serving multiple moving companies, that protection must begin with strict organization-level separation.
Start with tenant isolation
In a multi-tenant application, each moving company is a separate organization. Every business record – including locations, users, leads, customers, estimates, jobs, tasks, communications, documents, and settings – should belong to an organization.
The server must determine the active organization from the authenticated user’s membership and apply that organization to every data read and write. A request should never be trusted simply because it includes an organization identifier from the browser.
This boundary is different from a screen filter. It is a core authorization rule that should be enforced consistently in the application and database access layer.
Use roles that match moving-company work
Generic “user” and “manager” roles often create either too much access or too many workarounds. A moving platform benefits from roles aligned to the operation:
- Owner: company-wide administration, reporting, billing, and control.
- Admin: broad operational configuration and user management.
- Sales: leads, customer conversations, follow-ups, and estimates.
- Estimator: surveys, services, pricing, and estimate preparation.
- Dispatcher: calendar, jobs, crews, trucks, and assignments.
- Office Staff: customer service, records, documents, and approved operational tasks.
- Crew Leader: assigned job details, crew coordination, status, and field documentation.
- Crew Member: limited access to assigned work and required job-day information.
The exact permission set should be reviewed by each company. Role names describe responsibility, but permissions enforce it.
Apply least privilege
Least privilege means giving a person the minimum access needed to perform current responsibilities. A crew member generally does not need revenue reports or all customer records. A salesperson may not need to edit fleet maintenance. An estimator may need pricing tools without user-administration access.
Start with a conservative permission set, test real tasks, and add access deliberately. Review permissions when an employee changes roles or locations.
Protect high-impact actions
Some actions deserve additional controls because they affect money, access, or customer commitments. Examples include changing company settings, inviting users, altering rates, deleting records, issuing refunds, marking deposits, or entering a customer-support session.
Use server-side permission checks for every protected action. Interface controls can make the experience clearer, but hiding a button is not a security boundary.
Keep an activity trail
An activity trail helps the team understand what happened and supports accountability. Useful events include lead assignment, stage changes, estimate delivery and acceptance, job reassignment, document actions, payment events, and administrative changes.
Logs should identify the organization, record, actor, action, and time. They should avoid storing secrets or unnecessary sensitive content.
Use secure customer links
Customers should not need an employee account to review an estimate. A secure public experience can use a high-entropy, expiring, and revocable token tied to one estimate and one organization. Store only a protected representation of the token where practical, and limit what the link can access.
Acceptance, signatures, and deposits should produce recorded events so the moving company can see progress without exposing internal screens.
Review access as the company grows
Add an access review to onboarding and offboarding. Disable former users promptly, verify administrator accounts, and check that location assignments remain correct. Encourage unique accounts instead of shared credentials so actions can be attributed accurately.
Connected software is most valuable when people trust the boundaries around the data. Tenant isolation, role-specific permissions, secure public links, and visible activity together create a practical foundation for that trust.
MoveOS is designed around separate company workspaces and moving-specific roles. Contact MoveOS to discuss your organization structure, locations, and access requirements.