Skip to content
dotlossruns.com
Menu

How to verify the toolkit keeps your clients' data in your browser

In the agent toolkit at /app, client details stay in your browser and your own mailbox. Your clients' USDOT numbers never reach our servers. You don't have to take our word for it: your browser shows every request a page makes.

This applies to the toolkit only. The single-USDOT search on the home page and the letter generator's “Prefill from FMCSA” ask our server for the FMCSA record, as the privacy policy explains.

Check it in DevTools (2 minutes)

  1. Open the toolkit at /app in Chrome, Edge or Firefox.
  2. Open DevTools: press F12 (Windows) or Cmd+Option+I (Mac), then choose the Network tab.
  3. Tick “Preserve log”, then reload the page so the list starts empty.
  4. Paste a test USDOT (for example 80806) and press Look up. Create requests, open the tracker, download a PDF.
  5. In the Network filter box type the USDOT you used. Every row that appears must go to data.transportation.gov. None may go to dotlossruns.com.
  6. Then filter by “dotlossruns.com” and click through the requests: open Headers and Payload. You will see page files and page prefetches, never the USDOT.

Exactly which hosts /app contacts

  • dotlossruns.com

    The page itself, its scripts, styles, fonts and images. None of these requests carries a USDOT, a client name or anything you typed. The one exception you choose to send: the “Did this contact work?” buttons in the tracker send the insurer and the outcome to /api/report, with no USDOT and no client.

  • data.transportation.gov

    FMCSA's public data portal. Your browser asks it directly for each USDOT's company record and insurance filings (datasets inys-ebih, c5y8-a4uz, 3uet-3z4i, az4n-8mr2, qh9u-swkp and 6sqe-dvqs).

When you send a request, the Gmail, Outlook and mail-app buttons open your own mail with the draft filled in: that is your mailbox, not ours. The browser also enforces this list: when you open /app directly (typing the address, a bookmark, a link from another site or a reload), it is served with a Content-Security-Policy whose connect-src allows only this site and data.transportation.gov, so the page cannot send data anywhere else. Links into the toolkit on this site, and the toolkit's own header and footer links, are plain links that load the page fresh, so the policy applies there too. To be certain, reload /app before you start: the policy comes with every fresh load of the page.

Where your data lives

  • Your letterhead: this browser's local storage. “Clear” on the letterhead step deletes it.
  • The tracker: this browser's IndexedDB. Download a backup to keep a copy; clearing site data deletes it.
  • USDOT numbers: page memory, and the part of the address after “#”, which browsers never send to a server.
  • Letters and PDFs: built in your browser and saved to your device.
  • No analytics script runs on /app.

Open the toolkit →