Built so you don't have to trust us.
A registry's only asset is that its record is believed. So the design goal everywhere is the same: make every guarantee checkable by the person relying on it, and make the sensitive thing impossible to hold rather than promising to hold it carefully.
Row-level security, enforced in the database
Every table is guarded by Postgres row-level security keyed to workspace membership. The browser only ever holds a publishable key; a signed-in session can read exactly its own tenant's rows and nothing else, enforced by the database engine itself — not by application code that could have a bug.
Hash-chained ledger → hourly anchors → public checkpoints
Evidence is append-only. Each event cites the SHA-256 of the one before it; each account's chain rolls up into an hourly Merkle anchor; all anchors roll up into a global transparency checkpoint — the Certificate Transparency pattern. Rewriting history would require republishing commitments others may already hold. Inclusion proofs verify in your browser with crypto.subtle.
A schema that can't carry your secrets
The ingest payload is deliberately narrow: opaque codes, closed enums, bucketed counts. There is no free-text field, so a record cannot contain a prompt, a customer name, a document, or a key. The safest data is the field that doesn't exist.
Your keys never leave your machine
The relay collector runs beside your agents, on your infrastructure. To verify a credential it makes one harmless, read-only call to the provider from your machine and reports only the answer — a status code and a rung. The registry never sees, stores, or transports the key itself.
Hardware-backed human sign-off
Consequential actions wait for a human, and the approval is a WebAuthn passkey signature — Touch ID or Face ID on an enrolled device. The signature record attests which device signed, is bound to the exact payload approved, and is re-verifiable later by anyone.
Card data never touches us
Checkout and billing run entirely on Stripe's hosted surfaces. We store a customer reference and a subscription status — never card numbers. Plan changes are driven only by Stripe's signed webhooks, verified with HMAC-SHA256 before a single row changes.
Strict content security policy
Every page we serve ships a restrictive CSP — no third-party scripts, no frames, no form exfiltration targets — and public pages are served with no-referrer and content-type hardening. The marketing site you're reading runs under the same policy as the console.
Found something? Tell us directly.
We're in Early Access and we'd rather hear it from you than anyone else: security@fleetregistry.ai. Good-faith research is welcome; we'll respond fast and credit you if you'd like.
What we are, and aren't, today.
FleetRegistry is a young product in Early Access. We do not yet hold formal certifications (SOC 2 is on the roadmap with our first enterprise design partners), and Early Access terms apply. What we can offer today is stronger than a promise: guarantees you can check yourself — the chain, the anchors, the checkpoints, and a schema that can't hold your secrets. Measurement, not a rating; evidence, not assurances.