2026 customs changesWhat it means
Security & architecture

Trust you can verify - not just badges

Procurement does not take trust on faith - it tests it. So we lead with what you can verify yourself: an architecture you can interrogate, an audit trail you can pull, and a free accuracy bake-off on your own files. Here is exactly how CargoLint handles your data.

Architecture

The four things procurement actually tests

Per-tenant isolation

Every workspace is isolated. Documents live in a dedicated encrypted container per organization, and tenant scoping is enforced at two independent layers: the application and row-level security in the database itself.

No public-model training

Your documents and corrections are never used to train shared or public models. The only learning loop is scoped to your own workspace - and you can turn even that off.

Deterministic tariff anchor

HS classification is grounded, not guessed. Candidates are retrieved from the official HS schedule and re-ranked with GRI reasoning, then checked against tariff content - so a recommendation always traces back to a real code.

Immutable audit lineage

Every document carries a provable chain of custody: the original file, the extracted text with per-field confidence, who reviewed and changed what, and the compliance result - exportable as a one-click audit packet.

Authentication & access

Enterprise-grade sign-in and API access

JWT authentication
OAuth sign-in (Google, Microsoft)
Two-factor authentication
API key management - create and revoke
HMAC-SHA256 signed webhooks you can verify
Data handling & compliance

Your data stays yours

Documents stored in Azure Blob Storage, encrypted at rest - Enterprise plans use a dedicated per-tenant encryption key
Per-organization isolation enforced by database row-level security
Every upload scanned for malware with Microsoft Defender before processing
Customer-directed retention: 10-year default, configurable 1-10 years per organization, with legal hold
Storage versioning with a 30-day recovery window against accidental deletion
GDPR data export - download your full account data
Full, immutable audit logging - document access logs retained for 10 years
Human-in-the-loop: anything below the 70% confidence threshold is held for review
A copilot, not a licensed broker

CargoLint speeds up and error-checks your licensed staff. It does not file on your license.

Customs broker licensing attaches to the people and businesses conducting customs business, never to software. You approve every result and stay in control. CargoLint reads the documents, recommends, and flags - your team decides.

Put it to the test

The fastest way to evaluate us is on your own documents - send your toughest files and get a side-by-side accuracy report, no obligation.