Security & data practices

Transport and storage

Remote access requires HTTPS with TLS in transit. The built-in HTTP server is a local preview; a production TLS gateway must be configured before public hosting. Supabase Postgres stores the working set with provider-managed encryption at rest. Encryption does not replace access controls or careful credential handling.

API credentials

API requests use bearer tokens. Only SHA-256 hashes of API tokens are stored in the database. Treat the original token as a secret; rotating an account key revokes the previous key. Keep credentials out of URLs and logs.

Public records and privacy

Carrier evidence comes only from public records. Public records can still contain personal information. We do not sell or share carrier PII with third parties; the product displays relevant public-record evidence to users for diligence. Infrastructure providers process stored data to operate the service.

Lookup telemetry records the carrier USDOT, channel, source coverage and engagement, with an existing account ID when available. It does not collect IP addresses, user agents, email addresses or persistent browser identifiers. Telemetry has 30-day retention.

Disputes and corrections

Use the correction form with an account to identify the USDOT, disputed field, proposed correction and supporting public evidence. Submissions enter pending review; submitting does not automatically alter a source fact or establish a finding. Source records and dates remain visible. No response-time guarantee is offered.