Evidence
Every score comes with a record you can check.
An attestation is only useful if someone who does not trust Sentinel can still rely on it. This page shows what the record contains, how to verify it, and the research that makes it necessary.
The attestation
One record per shipment per window. Illustrative values.
{ "attestation_id": "att_7f3c91e2", "shipment_id": "CW1-NGB-MSA-20417", "window_start": "2026-11-05T14:15:00Z", "window_end": "2026-11-05T14:30:00Z", "concordance": 0.21, "threshold": 0.85, "sources_used": ["tracker", "cell_triangulation", "carrier_edi", "terminal_gate"], "risk_flags": ["position_drift_191km", "carrier_silent_since_phoenix", "arrival_unconfirmed_mesa"], "red_team_findings": [], "signature": "MEUCIQDx…9kQ=", "public_key_id": "sentinel-prod-2026" }
Time-bounded
Each record covers a fixed window, so evidence lines up with the exact minutes a claim is about.
Independently verifiable
Signed with a hardware-held key. The public key is published, so a reinsurer can check it without asking us.
Shows its sources
The record names which feeds agreed and which did not, so a low score can be explained, not just reported.
| Field | Meaning |
|---|---|
attestation_id | Unique identifier for this record |
shipment_id | The shipment reference, for example the CargoWise job number |
window_start, window_end | The UTC period the record covers |
concordance, threshold | How strongly independent sources agreed with the tracker, and the level below which a shipment is flagged |
sources_used | Which independent sources contributed to the score |
risk_flags | Specific divergences found in the window |
red_team_findings | Results of any authorized test exercise that affects the window |
signature, public_key_id | The signature over every other field, and which published key verifies it |
How to verify one
Find the public key
Look up the key named in
public_key_idon this page.Rebuild the signed content
Take every field except
signature, in a canonical form: keys sorted, no extra whitespace.Check the signature
Use any standard cryptography library. A valid signature proves the record has not changed since Sentinel signed it.
Check the window
Confirm the window covers the time the claim is about.
Production public keys and the exact canonical format will be published here when the first pilot starts.
Why independent verification
The monitoring layer is now part of the attack surface. Each point below links to its primary source.
GPS spoofing in data-center cargo theft
More than $100 million in data-center equipment stolen in transit in the U.S. since June 2026, with at least one case of a spoofed signal keeping a diverted trailer “on route”.
Summary of the NBC News investigationDefault credentials on GPS trackers
SinoTrack devices use a printed identifier and a shared default password. Exploitation can reveal vehicle location and, on some models, cut the fuel pump.
CISA advisory ICSA-25-160-01Metadata leaks from encrypted LoRaWAN
A 2026 study modeled on Rotterdam port traffic found replay, jamming and re-identification risks even with AES-128 payload encryption.
MDPI, Journal of Cybersecurity and PrivacyVessel data gateway flaws
Three vulnerabilities in NAVTOR NavBox gateways allowed unauthenticated access to configuration and operational data. NAVTOR has issued fixes.
Cydome advisoryUndocumented commands in ESP32 chips
Debug commands found in the original ESP32 Bluetooth controller. The manufacturer says they are not reachable remotely; an attacker needs host-level access first.
Espressif’s responseCyber-enabled theft and cargo cover
Lloyd’s market wording JC2025-026 confirms that physical theft stays covered when a cyber event only facilitates it, which puts the integrity of monitoring evidence at the center of claims.
Lloyd’s Market Association notice