Submitted reports are designed around immutable records and server-side timestamps.
Security
Report integrity is treated as a product feature.
VerifGo is built around a simple idea: once a daily verification report is submitted, the record should be clear, controlled, and resistant to casual tampering.
Immutable directionLeast privilegeNo approval claim
Driver-owned records stay separated through the security model.
Security controls do not imply regulator endorsement or legal protection.
Security controls in the product direction
- Submitted reports are designed to stay immutable after submission.
- Server-side submitted timestamps and integrity hashing support report review.
- Driver access is designed around least-privilege rules, including row-level security for driver-owned records.
- Privacy-minimized local diagnostics and smoke-test workflows are used to catch founder-test regressions before release decisions.
Clear boundaries
- Security posture does not mean regulator approval.
- VerifGo does not create backdated or fake reports.
- The wider pilot waits for Day-0 phone evidence, support/legal readiness, and controlled-pilot approval.
Current readiness
The MVP has passed current local verification and device readiness checks with documented risks. Protected remote E2E is green, while wider testing still waits for approved support, legal review, Day-0 phone evidence, and founder-usage evidence.