Anyone can write “bank-grade security” on a website. We would rather show you how ours works and give you the means to check it: every operation on your documents is sealed into a hash chain you can verify yourself.
Everything that happens to a document — activation, in-route changes, incidents, inspection downloads — is written to an append-only history. And every entry is cryptographically sealed to the previous one.
The first link (genesis) is derived from the document's unique identifier. From there, every operation records what happened, when, and what changed — always preserving the previous value — and is sealed with a SHA-256 hash that incorporates the hash of the preceding link.
The consequence is mathematical, not commercial: the past cannot be rewritten without breaking every later seal. Not one of our employees, not an attacker, not even we ourselves can alter a recorded operation without the chain failing to add up.
You may have seen the word “blockchain” used as decoration in this industry: a badge on a website with nothing the customer can actually check. Our position is the opposite:fewer buzzwords, more verification. The chain exists in every document, it is yours, and it verifies with standard tooling — no tokens, no cryptocurrency, no faith required.
In a dispute or a claim, that sealed history is your evidence: who changed the plate, when the PDF was downloaded at a roadside inspection, and which version was current at every moment.
Link 0 · Genesis
Derived from the document’s unique identifier. It anchors the chain: nobody can “start over” without it showing.
SHA-256 hash: 4c81f0a2d9e6…
Operation 1 · Activation
previous hash: 4c81f0a2d9e6…
Document activated · PDF v1 generated · 2026-10-06 07:41:02 UTC
SHA-256 hash: a97e30c5b1d4…
Operation 2 · Plate change
previous hash: a97e30c5b1d4…
Field: plate · previous value preserved · reason recorded · PDF v2
SHA-256 hash: f2154d8be07a…
Operation 3 · Roadside inspection download
previous hash: f2154d8be07a…
Current PDF downloaded from the public URL (QR) · kept as evidence
SHA-256 hash: 08d39cc471f6…
Every document keeps its full operation history, including the hash of every link.
With any standard SHA-256 implementation — yours, not ours — recompute the chain link by link.
If every recomputed hash matches the recorded one, the history is intact. Had anyone touched anything, none of the later hashes would match.
The baseline measures, described without fog: what we protect, where, and how.
A transport document does not end when the journey ends: the law requires keeping it and being able to produce it.
If an officer scans the QR and the document does not download, the problem is yours and your driver's. So this component is treated differently from everything else.
If you have found a vulnerability, we want to know — and we make it easy.
Write tosecurity@deca.examplewith the technical details and reproduction steps. We commit to acknowledging within 48 working hours, to taking no legal action against good-faith research, and to informing you of the resolution. This information is also published in the standard format at/.well-known/security.txt.
Looking for the SLA, the DPA or the subprocessor list? The whole due-diligence pack is published on thetrust & due diligence page.
89daysuntil 5 October 2026
10 free documents when you sign up. Each one carries its hash chain from the very first second.