Verification, not belief.
TrackJet is built so you do not have to take our word for anything: histories are sealed, seals are publicly anchored, analytics are cookieless, and our uptime is self-measured in the open.
Cryptographic transparency
Sealed timelines (tjvt2)
Each tracked chain's events are sealed into a SHA-256 hash chain at ingest — 39 seals live today. Editing, deleting or reordering any past event breaks verification, and the breakage is the proof.
Spec →Public Merkle log (tjmt1)
All sealed heads anchor into an append-only Merkle root history (56 roots published). Inclusion proofs verify OFFLINE with the open-source tjverify CLI.
Root history (live JSON) →Privacy engineering
Cookieless analytics
No cookies, no consent banner needed: sessions are an irreversible server-side hash with a daily-rotating salt that lives only in memory. Query strings are never stored.
Privacy policy →PII vault + crypto-shredding
Sensitive third-party fields are encrypted per-field (XSalsa20-Poly1305, keys outside the database). Deleting your account shreds keys — data becomes permanently unreadable, with a receipt.
Privacy center →Operations
Self-measured uptime
A canary exercises the real user paths around the clock. Last 30 days: 100.00%. The status page shows the same data we see.
Network status →Tamper-evident audit log
Admin actions are sealed into their own hash chain; a deleted or edited audit row is detected — and recoverable byte-exact from its seal. This has caught a real bug in production.
How sealing works →Restore drills, not hope
Backups are restored into a scratch database every week and verified against minimum row counts. A backup that has never been restored is a hope, not a backup.
This page →Read-only degradation
During maintenance the public site degrades to read-only: tracking keeps serving while writes get a friendly 503 with Retry-After — never a hard outage for readers.
Status →Source levels
Every event in a TrackJet timeline carries a source label. Here is what each level means — strongest evidence first:
| Level | Source | What it means | Label shown |
|---|---|---|---|
| L1 | Licensed carrier API | Real events pulled from a carrier's licensed feed (today: DHL Group via UTAPI). | Source: DHL UTAPI |
| L2 | User-authorised email import | Events parsed from the carrier status emails you forward to your personal TrackJet address. | Source: User-forwarded email |
| L3 | TrackJet saved timeline | Events TrackJet recorded earlier and stored in its verifiable, tamper-evident chain. | Source: TrackJet cached timeline |
| L4 | Official carrier tracking link | No event feed for this shipment — we route you to the carrier's own official tracking page. | Source: Official carrier page |
| L5 | Directory fallback | We recognise the carrier but it only exposes a search page; paste your number there. | Source: Redirect only |
TrackJet never fabricates carrier events. When we have no real event we say so and route you to the official source — we never invent a status.
Declared events — a separate class, not a sixth level
Declared by a named personA shipper, forwarder or warehouse can record an event no carrier feed reports — "loaded at ramp 4", "customs paperwork handed over". TrackJet stores it with the name and the organisation of whoever asserted it, seals it into its own tamper-evident chain, and marks it as declared on every surface where it appears.
It is deliberately not ranked against L1–L5. Those five answer where a machine record came from; a declaration is a different kind of claim — a person’s word, with someone accountable for it. TrackJet never converts a declaration into a carrier event. The API, the exports, the webhooks and the signed passport all carry the class, so your systems can treat the two differently. An author can withdraw a declaration: the withdrawal is recorded and the original stays sealed.
Estimated values — computed by TrackJet, never an observation
Estimated by TrackJetArrival windows, great-circle distances and route transit statistics are calculated by us from the data we hold. Nobody observed them. They are always labelled, and a distance we derive from two coordinates says "estimated · great-circle" rather than pretending to be a driven or flown route.
Transit statistics stay silent until a route has at least ten real observations, because an average over three shipments is a guess wearing a number. An estimated position is never presented as GPS. Like declared events, estimates carry their class through the API, the exports and the webhooks, so you can drop them from any report that must contain only what was actually reported.
Compliance & legal resources
A GDPR Art. 28 DPA and the current subprocessor list are available on request at [email protected]; a downloadable DPA pack ships with the legal-entity / billing go-live.
Certifications. TrackJet does not yet hold a formal SOC 2 or ISO/IEC 27001 certification. The controls such an audit assesses are already in place and visible above: EU-only hosting, encryption in transit and at rest, a tamper-evident audit chain with a publicly anchored Merkle root, weekly restore drills, cookieless analytics, and a published vulnerability-disclosure policy. For a formal security review, request our security-posture summary and Art. 28 DPA at [email protected].