Trust and data

Beta: CarrierVet is in active testing. Verify critical decisions against FMCSA SAFER, and report anything that looks wrong to hello@carriervet.dev.

How CarrierVet gets its data, how verdicts are made, how they are checked, and what protects your account. CarrierVet is in beta: support is best effort and there is no SLA.

Data provenance and freshness

• Verified against official FMCSA records. A carrier's first lookup is fetched at request time; repeat lookups use a stored copy that is refreshed at least daily.
• Out-of-service orders are checked on every lookup.
• FMCSA's daily authority, insurance and revocation changes are applied each day, and dated changes are recorded in an append-only history (GET /v1/carriers/{dot}/history; recording started 2026-10-27).
• When sources disagree about operating authority, CarrierVet confirms with FMCSA's SAFER snapshot and returns REVIEW rather than guessing.
• Every response says how current and how complete it is: the x-data-freshness header, snapshot_date, and data_quality (completeness, missing parts, which sources answered). A stale or incomplete record is flagged data_stale / data_incomplete instead of passing quietly.
• Carriers can request a review of a record or flag.

How the verdict and risk score work

• The verdict combines the authority, insurance, out-of-service, operating-status, safety-rating and data-quality checks: FAIL if any check fails, REVIEW if any is flagged, PASS otherwise. Every verdict lists its reasons (example, explained).
• The risk score (0–100) adds signals such as young authority, recent contact changes and contact details shared with other carriers. Hard failures keep the score at 50 or more.
• CarrierVet gives explainable evidence; you make the decision. POST /v1/eligibility applies your own rules without changing the verdict.

Validation

• The public track record freezes the risk calls each day (hash-chained, so they can't be edited later) and scores them against what FMCSA records show 30, 60 and 90 days later. Results that haven't matured yet are shown as pending.
• A nightly accuracy check compares a random sample of verdicts and fields with FMCSA sources.

Security controls in place

• API keys are long random tokens, shown once and stored only as SHA-256 hashes. Keys can be rotated and revoked. Passwords are stored as salted PBKDF2 hashes.
• HTTPS only: HTTP redirects to HTTPS, HSTS is sent, and TLS 1.2 or newer is required.
• Each account can read only its own keys, usage, monitors and receipts; receipt ids are random.
• Rate limits per key, per IP, and on signup, login and the MCP endpoint.
• Outgoing alert webhooks are signed (HMAC-SHA256 with a timestamp), and private or internal addresses are refused. Incoming Stripe webhooks are signature-checked.
• Email from carriervet.dev is DKIM-signed and published with SPF and a DMARC quarantine policy, so mail that spoofs the domain is not delivered as ours.
• Security headers on every page (HSTS, nosniff, frame blocking, referrer and permissions policies). DNS records are protected by DNSSEC and CAA.

Status and incidents

• Live status: /status (human-readable) and /health (JSON: database, live FMCSA lookups, last successful data refresh per source). There is no historical uptime figure yet.
• When FMCSA is slow or down, uncached lookups return 202 or 503 with retry_after and are not charged; cached lookups keep working and are marked stale.
• If a release misbehaves, it is rolled back to the previous version. Report problems to hello@carriervet.dev.

Support

Email hello@carriervet.dev. Beta, best effort; no SLA. See also the Terms and Privacy pages.

Get a free API key 50 lookups a month, no card. Paid plans open after the beta.

Not a consumer report. Carrier data is derived from records maintained by the Federal Motor Carrier Safety Administration (FMCSA). It is provided as-is, may be delayed or incomplete, and is not a consumer report under the Fair Credit Reporting Act. Do not use it to evaluate a natural person for credit, insurance, employment, or any other purpose covered by the FCRA. Questions: hello@carriervet.dev.