Password resets are the most common support ticket in any SaaS product. A user forgets their password on Monday morning, clicks “reset,” the email goes to spam, they submit another ticket, and the dispatcher is down for 20 minutes while the office scrambles to get them logged in.
In a moving company, 20 minutes on a Monday morning is four leads that didn’t get called back. It’s a crew that left without the updated work order. It’s a customer who called and got voicemail.
Auth is not a security feature. Auth is an ease-of-use feature. Every password reset that doesn’t happen is a Monday morning that starts with a move, not a helpdesk call.
What FusionAuth Replaces
MoveRight used to authenticate users through Neo4j’s built-in auth. It worked. It also meant:
- Passwords were stored and validated inside the same database that runs the application.
- 2FA was bolted on, not built in.
- There were no passkeys. No passwordless login. No session management.
- Password resets were a manual flow with edge cases that broke for users with duplicate emails or phone-only accounts.
- The login page was a generic form, not branded.
In August 2026 (Changelog_2608.md !2257), we migrated MoveRight to FusionAuth. FusionAuth is a dedicated authentication platform that handles login, 2FA, passkeys, session management, password resets, and user provisioning — all outside the application database.
The Migration: 1,880 Users, No Cutover Event
Here’s what the migration looked like in numbers:
- 1,880 users moved from Neo4j auth to FusionAuth in a single release.
- Bcrypt password hashes migrated directly — users kept their existing passwords. No forced reset.
- 2FA secrets migrated — users who had 2FA enrolled kept it. No re-enrollment.
- Phone numbers migrated — users who authenticated by phone kept that capability.
- Duplicate handling built in — when multiple Neo4j users shared the same email, the migration preferred admin/employee users over customer-only users.
- No cutover event. No maintenance window. No downtime. No “MoveRight will be unavailable on Saturday from 2–4 AM.”
The coexistence model made this possible. Old cached PWA versions kept using legacy Neo4j auth. New frontend versions used FusionAuth. Both paths worked simultaneously. As users’ cached PWAs aged out and reloaded, they moved to FusionAuth naturally. The old auth path didn’t need to be shut off — it just stopped being used.
This is the same engine-agnostic approach we used for the PandaDoc-to-AegisDoc migration: no forced cutover, no migration event, no risk. Both systems run in parallel until the old one is empty.
What Changed for the User
| Before (Neo4j auth) | After (FusionAuth) |
|---|---|
| Password required | Passkeys — log in with Face ID, Touch ID, or Windows Hello. No password. |
| 2FA bolted on, manual enrollment | 2FA enrollment in the account page. Self-service. No admin involvement. |
| Password reset via email (often to spam) | Passwordless email/SMS — one-time code, no password to forget. |
| Generic login form | Branded MoveRight login page. Looks like the product, not a third-party form. |
| No session visibility | Session management — see active sessions, revoke from the account page. |
| Password validation forced changes on migrated users | Min 12 chars, validateOnLogin disabled — migrated users aren’t forced to change passwords on first login. |
The passkeys piece is the one that matters most. A user with a passkey-enabled device — an iPhone with Face ID, an Android with fingerprint unlock, a laptop with Touch ID or Windows Hello — can log in without a password. Not “log in with a password and then set up a passkey.” Log in with their face or their fingerprint. No password to forget. No password to reset. No password to phish.
Passwordless email and SMS cover the users who don’t have a passkey-enabled device. They enter their email or phone, get a one-time code, and they’re in. No password. No reset flow. No spam folder problem.
Session management closes the loop. A dispatcher who logged in on a shared computer in the break room can kill that session from their phone. An ops manager who left their laptop at the office can see whether someone else has been using their account. Every active session is visible, and every one is revocable.
Why Auth Is an Ease-of-Use Feature
We wrote about this in Why MoveRight Is the Easiest Moving Software to Use. Easy isn’t a marketing word. It’s a list of friction points removed, each with a date and a changelog reference.
Auth is on that list. Here’s why:
- Every password reset that doesn’t happen is a support ticket that doesn’t get filed. That’s dispatcher time saved on Monday morning.
- Every passkey login is a login that takes 2 seconds instead of 20. That’s not a big number per user, per day. It’s a big number across 1,880 users, every day, for a year.
- Every session a user can revoke themselves is a support call to the office that doesn’t happen. “I think someone else is logged into my account” becomes a 10-second fix in the account page, not a 20-minute IT ticket.
Moving company software security is not about compliance frameworks. It’s about whether your dispatcher can log in on Monday morning without calling someone. FusionAuth makes the answer yes.
The Coexistence Model
The migration is done, but the old auth path is still technically present. Old cached PWA versions — the progressive web app that a user installed on their phone six months ago and hasn’t reloaded — still authenticate through Neo4j. New frontend versions authenticate through FusionAuth.
This is not a problem. It’s the design. The old PWA ages out as users reload. The new frontend is FusionAuth from the first load. There is no deadline, no forced upgrade, no “please clear your cache” email. The system handles it.
The same model handled the AegisDoc migration: both engines ran in parallel, zones flipped when ready, and the old engine stayed available until nobody was using it. Auth works the same way.
What This Means for Moving Company Software Security
Most moving company software still runs on password-plus-optional-2FA. The password is the weak link. It gets forgotten, it gets reused, it gets phished, and it generates the most support tickets of any feature in the product.
FusionAuth removes the password as a failure mode. Passkeys replace it with something the user already has — their face, their fingerprint, their device. Passwordless email and SMS cover the rest. 2FA is built in, not bolted on. Session management gives the user control over their own security without a support ticket.
MoveRight is the moving company CRM that treats login as an ease-of-use feature — passkeys, 2FA, passwordless, session management — and migrates 1,880 users to it without a cutover event or a Monday morning helpdesk call.
References: