Five layers. One brain. Zero ad-network surveillance.
Most car-buying sites are lead farms — your name and number reach ten dealers in ten minutes, and the spam never stops. GoFetch is engineered so that the only people who see your information are the ones you explicitly say can.
Five layers of defense
Each layer is implemented in our own code, audited at every PR, and instrumented with cron health checks. No third-party security-theatre dependencies.
01
Driver's license images, ID OCR fields, addresses, credit pre-qual pulls — all AES-GCM encrypted at the application layer before Postgres ever sees them. Envelope-encrypted keys. We hash phones for dealer-side webhook matching so plaintext never has to leave our keystore.
02
RFC 6238 implementation. AES-GCM wrapped secrets, bcrypt-hashed backup codes, 5-minute pending-MFA cookie for the challenge flow. Required on every buyer portal session that touches an active deal in F&I.
03
Embedded request-wire on every endpoint. Per-request bot scoring, kill-chain detection, JA3/JA4 TLS fingerprinting, Claude Haiku attack-intent explanation layer. 66 diagnostic rules, 53 error signatures, 261 root causes. IQ 145 self-grading.
04
Every FetchEye marketplace bid carries a scoped routing token. Tokens are dealer-bound, time-bound, and HMAC-signed. A compromised dealer account cannot see another dealer's bid book, buyer roster, or fee structure. Cross-tenant queries throw at the model layer.
05
Buyers, deals, dealer messages, and portal events are never hard-deleted — only flagged via deletedAt. Every state change writes an activity row. Crons are instrumented through cron_runs for retroactive forensics on any disputed deal.
The AI watchdog
Autonomous Web Application Intelligence System. Embedded inside the app — not bolted on like a WAF. Learns attacker playbooks, plants deception, evolves its own rules, and watches all five products in the Gladius ecosystem — including GoFetch — through one brain.
$ awais --status --verbose
iq_score ........ 145
rules_active .... 66 / 66
signatures ...... 53 / 53
patterns ........ 261 / 261
products ........ 5 (mesh OK)
mesh_lag ........ 11s (p95)
ready. watching all surfaces.
What we’re certified for
We publish where we’re compliant, where we’re in progress, and where the framework doesn’t apply. If you’re an auditor, your evidence packet is ready.
Column-level PII encryption, access controls, MFA on every account, encryption-in-transit (TLS 1.3 + HSTS preload), incident response plan, vendor risk management. Yes — it applies to us, because we facilitate the financing pre-qual.
Buyer non-public information (income, SSN-tails, credit pull) is encrypted in flight and at rest, dealer-scoped on disclosure, and never sold. Privacy notice surfaced to consumers via /privacy.
Trust services criteria mapped to controls. Continuous evidence collection in place. Auditor engagement targeted Q4 2026. We will publish the report under NDA on request.
Card data never touches our servers. Stripe Elements hosts the form; we receive only a tokenized reference. Out-of-scope for the full PCI envelope.
Request architecture
A request from a buyer’s phone or a dealer’s desk has to clear all six before it touches a database row. Each checkpoint is its own audit log.
01
Request
Browser → Vercel Edge / CDN. TLS 1.3, HSTS preload, COOP, CORP. Strict CSP rejects unknown script origins.
02
AWAIS gate
Every request screened by Defense — bot scoring, fingerprint, behavioral z-score, deception traps. Hostile traffic gets a doppler response, never the real route.
03
Next.js Edge / Node runtime
Stateless HMAC-signed session in an httpOnly + Secure + SameSite=Lax cookie. Homegrown auth — no third-party identity vendor dependency.
04
tRPC middleware (buyer / dealer gate)
Session decoded, role resolved, MFA verified. Buyer-side and dealer-side routes are split: a dealer-token request cannot reach a buyer-portal handler and vice versa. Every input passes Zod validation.
05
Prisma ORM
Parameterized queries only — no string-concat SQL anywhere in the surface. Buyer ID required on every read; cross-tenant queries throw at the model layer.
06
Postgres
Encrypted at rest. RLS policies as defense-in-depth. Backups encrypted with separate KMS keys. Soft-delete only on every revenue-bearing table.
vs. the lead-farm car-buying sites
Free car-buying sites work for dealers, not you. Here’s how GoFetch is engineered differently — because the buyer pays us, so the buyer is the customer.
Control
GoFetch
Typical lead-farm site
Buyer PII column-level encryption
AES-GCM in every PII column
Row-level disk encryption only
Lead resale to dealers
Never. Buyer pays us — dealers don't.
TrueCar / AAA / Costco — $299-$399 per lead
MFA enforcement
Required on every active deal session
Optional, opt-in only
Application-layer threat detection
AWAIS — embedded, self-learning
Perimeter WAF only
Dealer-side data isolation
Scoped HMAC tokens per dealer per deal
Shared CRM, app-level filter only
Breach disclosure SLA
72 hours, in writing, in the buyer contract
Silence until press inquiry
“Typical lead-farm site” column reflects publicly documented business models from TrueCar, AAA Auto, Costco Auto, and similar free-to-buyer aggregators. If a specific operator has since improved, send a pointer to security@gofetchauto.com and we’ll happily update.
Our pledges
These are not aspirations — they live in our service agreement and they hold in court.
Responsible disclosure
Email security@gofetchauto.com with a description, reproduction steps, and the impact you believe it has. We acknowledge within 24 hours, fix high-severity issues within 7 days, and pay a bounty from $250 for low-impact findings up to $10,000 for critical pre-auth RCE or cross-buyer data crossing. No legal action against good-faith researchers — that’s our pledge.
GoFetch Auto LLC · Tampa, FL · 2026