Skip to content

A report passes through six stages from vehicle intake to the seal

Below you can see, for every stage, who does what, where each piece of data comes from and whose approval seals the report.

Every stage has a named owner and a clear output

The stages run in the Ekspertiz centre's panel. The owner, input and output of each stage are listed below.

  1. 01

    Intake

    Branch staff

    The vehicle arrives at the centre and a work order is opened with the VIN, plate and odometer. The report is attached to that work order.

    Input
    VIN, plate and odometer
    Output
    Work order
  2. 02

    Assignment

    Branch manager

    The branch manager assigns the work order to a technician. The job appears in that technician's own work list.

    Input
    Work order and an available technician
    Output
    A new job in the technician's list
  3. 03

    Measurement

    Technician

    The technician fills in the package's modules and attaches photos to the module they belong to. When done, the technician sends the report to quality control.

    Input
    The vehicle and the modules in the package
    Output
    Completed modules and photos
  4. 04

    Quality control

    Branch manager

    The manager reviews the modules. Anything missing or inconsistent sends the report back to the technician to fix.

    Input
    A report waiting for quality control
    Output
    Approval, or a return to the technician
  5. 05

    Sealing

    Branch manager

    When the manager approves, the report is signed and linked to the previous report on the same car. From then on it cannot be edited.

    Input
    Approved report
    Output
    Sealed report
  6. 06

    Publication

    System

    A QR code is generated for the report. A buyer can verify it by report number or QR code without an account.

    Input
    Sealed report
    Output
    QR code and verification address

An Ekspertiz report is filled in module by module

The package the centre chooses decides which modules the report contains. Photos are attached to their module and stored with the report.

ModuleCode
Body and paintbody_paint
Paint thickness measurementpaint_thickness
Engine mechanicsmechanical
Engine performanceengine_dyno
Brake testbrake
Suspensionsuspension
Side sliplateral_slip
OBD electronicselectronic_obd
Tyres and brake padstire_wheel
Underbody checkundercarriage
Road testroad_test
Interior checkinterior
Exterior checkexterior
Gasket testgasket
Airbag checkairbag

After sealing, any change to the report shows up in verification

When the manager approves, the report is signed and linked to the previous report on the same car. If even one field changes after sealing, verification shows the report as altered.

The signing key stays on OtoTasdik's server. Its public half is published, so anyone can check a signature themselves.

Security architecture

Technical verification details

The report's content is turned into JSON with sorted keys. That text is joined with the previous report's digest on the same VIN and the sealing time, then hashed with SHA-256. The digest is signed with Ed25519. The work order behind a Service Statement is signed with the same key, using its own formula.

What gets signed, by record type

  1. 1. Ekspertiz report: digest

    report_hash = sha256(canonical_json(report) + previous_hash + finalized_at)
// previous_hash: digest of the latest report on the same VIN

  2. 2. Ekspertiz report: signature

    signature = ed25519_sign(key, report_hash)
// a 64-byte signature, checked with the published public key

  3. 3. Service Statement: content digest

    content_hash = sha256(canonical_json(work_order))
// the work order's canonical form, keys sorted

  4. 4. Service Statement: chained signature

    signature = ed25519_sign(key, "v2|" + content_hash + "|" + previous_hash
              + "|" + chain_index + "|" + chain_epoch + "|" + signed_at_unix)
// previous_hash: digest of the previous record on the same VIN, GENESIS for the first

  5. 5. Verification

    valid = recomputed_hash == stored_hash
        && ed25519_verify(public_key, signed_bytes, signature)
// the server recomputes the digest and checks the signature

Which data is kept where?

Records are stored in the EU, in AWS's Frankfurt region (eu-central-1). The legal basis for transfers abroad is set out in the privacy notice.

DataLocation
Reports and work ordersFrankfurt, EU
Photos and PDF filesFrankfurt, EU
Signing keyOtoTasdik's server in Frankfurt; the public half is published
Photos for the document scanOnly with explicit consent, Google Gemini (Google LLC, USA)

Let us answer your technical team's questions together

For Ekspertiz centres the panel opens as an invitation-only pilot. For questions about security or integration, you can arrange a call.

Request a callAbout the API