Security

Registration certificates, insurance documents and supporting uploads are written to a private storage vault. There is no public URL for an uploaded document.

Documents are transmitted over encrypted connections and are readable only by our verification team.

Application records are not exposed to the public interface. The public verification lookup is a narrow, read-only function that returns only the registration number, owner name and verified status of records already marked verified.

Pending and rejected applications never appear in any public response.

Verified status can only be set by our team after document review. It cannot be set from the public application form.

Status changes are recorded so that every verified record can be traced to a review decision.

If you believe you have found a security issue, email security@firsthandluxurycar.com with steps to reproduce. Please do not access or modify data that is not yours.

We aim to acknowledge reports within 3 working days and will keep you updated until the issue is resolved. We do not pursue legal action against researchers who follow this process in good faith.

Use a unique, current email address for your application, and tell us immediately if you lose access to it.

Never share your uploaded documents with anyone claiming to represent us over chat or phone; our team only requests documents through the application flow.