Shipment verification network · Pilot program
A sensor on the truck records what left. A sensor on the tank records what arrived. Freightville writes both readings to a tamper-evident ledger, compares them within your tolerance, and alerts the moment they don't agree.
Dispatched · AquaHaul
9,980 L
truck meter AH-FLOW-114-1 · sensor-attested
Received · Ridgeline Farms
9,942 L
tank meter RF-TANK-07-A · sensor-attested
How it works
No trust in either party's spreadsheet, and no arguing after the fact. Each reading is signed by the organization that took it, sealed into a block, and reconciled automatically.
SENSE
The dispatching meter and the receiving meter each record the quantity — flow meters, tank level sensors, scales, or a manual reading from the field app when hardware is down.
SIGN
Readings are cryptographically signed with the recording company's key. A shipper can't write a receiver's numbers, and nobody can rewrite a reading later.
SEAL
Named validator organizations countersign each block. A block is final only with a two-thirds majority — one party alone, including Freightville, can't alter the record.
RECONCILE
Out and in are matched per shipment and checked against the tolerance you set — per contract, per lane, per commodity, or a company default. Breaches alert immediately.
| Shipment | Route | Out | In | Δ | Tolerance | Status |
|---|---|---|---|---|---|---|
| FV-2231 | AquaHaul → Ridgeline | 9,980 L | 9,942 L | 0.38% | 0.75% · lane | VERIFIED |
| FV-2232 | AquaHaul → Ridgeline | 5,000 L | 4,968 L | 0.64% | 0.75% · lane | VERIFIED MANUAL — REVIEW |
| FV-2233 | AquaHaul → Ridgeline | 12,000 L | 11,280 L | 6.00% | 0.75% · lane | VARIANCE |
| FV-2230 | AquaHaul → Ridgeline | 8,000 L | — | — | 24 h window | UNPAIRED |
Output of the reference implementation in this repository — run python3 chain/demo.py to reproduce it, including the alert log and a rejected tamper attempt.
The ledger
Freightville runs a permissioned chain with Proof-of-Authority consensus. Validators are named, contracted organizations — not anonymous miners — because in freight, identity is the point.
> ⅔
A block is final only when more than two-thirds of validators have signed it. No single company — Freightville included — can alter or censor the record alone.
~0 kWh
Consensus work is an Ed25519 signature. The chain's energy budget is a handful of ordinary servers — the same class of machine that runs your dashboard.
Anchored
The chain's Merkle root is published to an external public record on a schedule. Even full validator collusion can't rewrite history older than the last anchor without detection.
Architecture
A ledger is a terrible query engine, and personal data must never be immutable. So Freightville puts each kind of information where it belongs — and keeps a rule for when they disagree.
Photos follow the same principle. A meter-face photograph from the field app lives in object storage; its SHA-256 fingerprint lives on the ledger. Anyone can prove the photo is the exact one recorded at delivery — without a multi-megabyte image bloating the chain, and while the file itself stays deletable.
The dashboard reads a projection built from the chain — fast to query, rebuildable from the ledger at any time, and continuously checked against it. If they ever disagree, the chain wins, and the disagreement is itself a security alert.
Standards & protocols
Every source — any manufacturer, any transport — is converted at the edge into one canonical event format. New protocols are new adapters; nothing downstream changes.
Accounts
Companies join as shippers, receivers, suppliers — or all three, since the same firm often receives at the depot and ships onward. Inside each company, three admin roles mirror the platform's own, scoped to that company alone.
| Role | Freightville staff — all accounts | Your company — your account only |
|---|---|---|
| Full Admin | Everything, including validator keys, billing, and role grants. Sensitive actions require two Full Admins. | Everything in your company: users, API keys, devices, role grants. |
| Site Admin | Configure tolerances, adapters, sites, and devices across all accounts. | Configure your sites, devices, tolerances, and integrations. |
| Support Admin | Read access for support — no configuration writes, no key access. Every read of customer data is itself written to the ledger. | Read access to your company's records and support tickets. |
Platform-wide access is audited by design: customers can see exactly when Freightville staff viewed their data, because those reads are on the ledger too.
In the field
The Freightville field app runs on any phone — it installs from the browser, works offline in yards with no signal, and syncs when coverage returns. When a meter is dead or a site has no sensor, the driver or the receiving operator records the reading by hand: quantity, a photograph of the meter face or gauge, GPS, and a timestamp, signed with their account key.
Manual entries are never laundered into looking like sensor data. Every reading carries its trust tier on the ledger, and reconciliation policy can treat tiers differently — a variance that clears on two attested sensors can still queue for review when a manual entry is involved.
Signed inside a tamper-evident device with a registered key.
Device reading relayed and signed by the operator's gateway.
Hand entry with meter photo, GPS, and timestamp.
Hand entry alone — accepted, flagged, and reviewable.
Partners
A verification network is only as good as its uptime — a reading that never arrives looks exactly like a delivery that never happened. We don't improvise that discipline in-house.
Ntersect provides Freightville's network observability. Their Ntrospect platform, built on OpenTelemetry, watches the paths our readings travel — sensor gateways, ingestion adapters, and validator nodes — with anomaly detection that surfaces degradation before it becomes a gap in the ledger.
When an UNPAIRED alert fires, the first question is whether the delivery failed or the network did. Ntersect's telemetry is how we answer it with evidence instead of a guess.
ntersect.com →Pilot program
The pilot starts small on purpose: one commodity, one route, both ends instrumented, your tolerance. If the numbers don't earn their keep in ninety days, walk away with your data.