Security
Every request is checked on our server
Your sign-in token is verified by our server on each request. Your role (car owner, fleet, workshop and so on) comes from our database, never from your browser, so it can’t be changed by editing the page.
You see only your own records
You can open vehicles you registered and those an owner has shared with your organisation. Anything else returns “not found”, so other people’s records can’t even be confirmed to exist.
Sharing needs your permission
A workshop or insurer sees a vehicle’s records only after you grant access, for a period you choose. You can revoke it at any time, and grants and revocations are logged.
Uploads are handled carefully
Only PDFs up to 10 MB are accepted, and the file is checked to really be a PDF. It is read to extract the figures and is not stored.
Limits against abuse
Requests are rate-limited, and the site sends standard browser security headers. Sign-up can only create car owner, fleet or workshop accounts.
Tamper-evident records
Saved checks get a SHA-256 fingerprint. When a ledger is connected, the fingerprint is anchored on Hyperledger Fabric; re-checking later shows whether the record was edited. It proves the record is unchanged, not that the events in it happened.
What we don’t do.
- Sell or share your data with insurers, brokers or advertisers
- Send anything to an insurer on your behalf
- Produce fraud or risk scores about you
- Keep the PDFs you upload
Found a security problem? Email sathvikkandukuri202@gmail.com. See also the privacy notice.