Dumpster Controls · agent page

This is the agent-optimized version of https://dumpstercontrols.io/help/api/api-security-model: the same content as the human page, without scripts, styles, animations or navigation. People should open the full page.

Canonical page
https://dumpstercontrols.io/help/api/api-security-model
Last updated
2026-08-22
Tokens
1,179 tokens (cl100k_base), within the 2,000-token budget for a help page
Size
9.1 KB for this page, against 21 KB for the human page (55% smaller)
Markdown
https://dumpstercontrols.io/help/api/api-security-model.md, or send Accept: text/markdown to the canonical URL
Cite as
The API security model, explained. Dumpster Controls. https://dumpstercontrols.io/help/api/api-security-model (accessed 2026-10-05).
More for agents
Facts sheet · llms.txt · llms-full.txt · All agent pages · Product manual

Developer API · updated 2026-08-22

The API security model, explained

This API was built approval-first and least-privilege from day one. This article explains each layer, both so you can trust it and so security reviewers on your side have their answers ready.

  1. ## Approval-gated by humans
    No key exists until the Dumpster Controls team approves your written request. The approval gate is re-checked on EVERY request, so a platform-side revocation cuts all of a company's keys instantly. This is deliberate: a free platform with an open self-serve API would be an abuse magnet.
  2. ## Keys are hashed, secrets shown once
    Only SHA-256 fingerprints of keys and one-time-displayed webhook secrets live in our database. Client applications, including our own web app, cannot read them back: management goes through audited server-side functions.
  3. ## Company scoping on every query
    The company attached to your key is resolved server-side and injected into every database query. There is no parameter you could pass to see another company's data; cross-company lookups return 404 as if the record did not exist.
  4. ## Field allowlists, not blocklists
    Every response is built from an explicit allowlist of fields. Consent records, internal notes, GPS coordinates, tokens, photos and risk states are simply never selected. New fields are added deliberately, never leaked by default.
  5. ## No browser access, no CORS
    The API rejects browser preflights on purpose. This is a feature: it makes the "paste the key into your website" mistake fail loudly in development instead of silently shipping a leaked credential.
  6. ## Money is out of scope
    Refunds, charges and price changes cannot be expressed in the API at all. Payment flows stay inside the platform with its own risk screening (Stripe Radar plus platform checks) and fraud protections. A stolen API key can read one company's operational data until revoked; it can never move a cent.
  7. ## Abuse ends accounts
    Per our Terms of Service (section 13): fraud, scams, card fraud or API abuse lead to immediate revocation and suspension or permanent banning, without prior notice. We built the fraud screening that protects your payments; the same posture protects the platform.

Related guides

© 2026 Dumpster Controls. All rights reserved. Made in the USA.

Frequently asked questions

Is Dumpster Controls really free?

Yes. The software is free: dispatch, online booking, the driver app, invoicing, the Tresha AI assistant and every other feature, with no monthly fee, no trial period and no credit card to sign up. The only cost on the free plan is optional card processing when a customer pays by card through the platform: 2.99% plus $3.99 per transaction on the free plan. An optional Unlimited plan at $169 per month lowers that to 2.99% plus $0.30. Prices as published on dumpstercontrols.io/pricing on 2026-09-23.

Do you charge per driver, per truck or per order?

No. There is no per-driver, per-truck, per-user or per-order fee, and no order limit. A company with one truck and a company with twenty pay the same for the software: nothing.

Is there a contract?

No. There is no contract, no minimum term and no setup fee. You create the account yourself, and on the free plan there is nothing to cancel because nothing is billed. The optional Unlimited plan is billed month to month.

Which countries and languages are supported?

Dumpster Controls serves hauling companies in the United States and Canada. The app interface and the Tresha AI assistant are available in English, Spanish and Portuguese. The public pages, such as the blog, the help center and the landfill finder, are in English.

How do I switch from another dumpster software?

Create a free account at dumpstercontrols.io/login, with no sales call and no credit card. Then import your customers from a CSV file using the template provided in the app; past orders can also be imported from a CSV. Container sizes and pricing are set up in Settings. The landfill database, with 1,750 active US and Canadian landfills as counted on 2026-10-01, is already loaded, so disposal sites do not need to be typed in. Step-by-step guides are at dumpstercontrols.io/help.