Security and data handling
What VerifyCarrier stores, how it is protected, how long it is kept and who processes it. The privacy policy is the legal statement; this page describes the implementation.
API keys
- A key is the prefix
vc_followed by 32 bytes from a cryptographic random generator, base64url encoded. - The full key is shown once, when you create it. VerifyCarrier stores a bcrypt hash of the key and its first 12 characters so you can tell your keys apart in the dashboard. The plain key is not stored.
- On each request the key's prefix selects the candidate rows and the bcrypt hash is compared. A deleted key fails that check immediately; deletion is revocation.
- Keys are sent as
Authorization: Bearer. Do not put a key in a URL, a public repository or a browser bundle. Metered responses report your remaining allowance inX-RateLimit-*headers so you can rotate without guessing.
Accounts and AI connectors
- Passwords are stored as bcrypt hashes. Password reset and email verification use single-use tokens sent by email.
- The Carrier Research connector for Claude signs you in on verifycarrier.com with OAuth 2.1 (PKCE, S256). Claude receives an access token valid for 15 minutes and a refresh token valid for 30 days. VerifyCarrier stores hashes of authorization codes and tokens, never the tokens.
- A connector token carries only your account number and the scope
carrier:research. It cannot read your watchlist, reviews, billing or password. Resetting your password ends every connector session at the next token refresh.
Your review decisions stay yours
Approved, needs-review and rejected decisions, your rationale and your checklist entries belong to your account. They are not shared with other customers, not shown on public carrier pages and not included in the evidence API, which returns public records only. Carrier alerts are sent to the email on your account and nowhere else.
Retention
| Data | Kept for |
|---|---|
| Operational carrier lookup logs (web lookups and metered API calls, including the requesting IP address) | 365 days. A scheduled job deletes older rows every week; the job logs table names and counts only. |
| Recent carriers in your dashboard | Your last 50 carriers from the past 90 days; you can clear this history yourself. |
| Account data | While the account is active, plus 90 days after a deletion request. |
| Email and SMS history | 2 years, for legal compliance. |
| Payment records | 7 years, for tax and accounting. |
| Public FMCSA change history (census diffs) | Kept indefinitely. It contains public carrier records, not personal data about you. |
Subprocessors
These services process data on VerifyCarrier's behalf. Each one is named because its client is in the application code; nothing else receives your data.
| Processor | Purpose |
|---|---|
| Vercel | Hosting, serverless functions and file storage for uploaded insurance certificates |
| Neon | PostgreSQL database for accounts, API keys, watchlists, reviews and the FMCSA change feed |
| Postmark | Transactional email: verification, password reset, carrier alerts |
| Stripe | Billing and card processing; VerifyCarrier never stores card numbers |
| Sentry | Error reporting; session replay is disabled |
| PostHog | Product analytics, only after you grant analytics consent; server receipts carry a pseudonymous id |
| Crisp | Live chat on the website |
Deleting your account
Email privacy@verifycarrier.com with the subject "Data Deletion Request" from the address on your account. Requests are processed within 30 days. Deletion removes your account information, watchlist, saved reviews, lookup history and connector records; payment records stay for the tax period above. The full procedure, including what may be retained, is on the data deletion page.
Transport and reporting
- All traffic is served over HTTPS. Responses carry
X-Content-Type-Options: nosniffandX-Frame-Options: DENY. - The evidence API responds with
Cache-Control: private, no-store, so carrier evidence tied to your key is not cached by intermediaries. - To report a security issue, email support@verifycarrier.com. Do not include API keys, passwords or card details in the report.