Security

Every stamp is hashed with SHA-256 together with the hash of the previous stamp, forming a per-vehicle chain that starts at that book’s own genesis record — so a chain cannot be transplanted from one vehicle to another. To be precise about what it is anchored to: neither DVLA nor DVSA gives us a VIN and nothing in the product asks you for one, so the anchor is the vehicle record itself and the registration history attached to it, not a VIN read off the frame. The application never updates or deletes a stamp — corrections are appended as new records with the originals preserved. Changing any historical record breaks every fingerprint after it, and the public verifier recomputes the whole chain from scratch on every check, so you never have to take our word for it.

No passwords to steal: sign-in uses single-use 6-digit email codes that expire after 10 minutes and lock after 5 wrong attempts (or Google sign-in). Sessions use short-lived (15-minute) access tokens with rotating refresh tokens. Signing out of this website revokes that session on our servers, not just in your browser, and the mobile app lists your signed-in devices so you can revoke any of them — including the one in your hand. Admin consoles carry their own claim, re-checked against the database on every request.

TLS 1.2+ for everything in transit. Compute runs in Vercel’s London region and the database is Neon Postgres in AWS eu-west-2 (London); both platforms encrypt data at rest. Uploaded documents live in a private Vercel Blob store — never publicly addressable — and are only served through short-lived HMAC-signed links (one hour), with keeper access re-checked on every read, so a leaked link dies with the claim. Our own staff can open a document from the admin console when they are investigating a keeper dispute or an abuse report. The one other way a document is ever readable is when the keeper deliberately ticks “include the paperwork” on a full-history share link: those files are then served through links bound to that share link, so revoking or expiring it kills them too, and V5C logbooks are excluded whatever the setting says. Files are stored byte-for-byte as uploaded (their SHA-256 is recorded at upload); we don’t currently scan or rewrite file contents, so strip photo metadata you’d rather not keep before uploading.

Endpoints are rate-limited (plate lookups: 30/min; sign-in code requests: 10/min, plus a per-recipient throttle so nobody can flood your inbox; everything else: 300/min). Plate lookups are recorded against a hashed IP — never the raw address — and deleted after 13 months. Shared books are fetched by our own server on the reader’s behalf, so a view record identifies nobody: the owner sees the count and the browser type, not who looked. Share links can be scoped, expired, view-capped and revoked by the owner.

Found something? Please email support@service-book.co.uk with “Security report” in the subject (the link prefills it — one inbox, read by the people who wrote the code) with steps to reproduce. We acknowledge within two working days, we won’t take legal action against good-faith research, and we credit reporters who want it.