For US trucking fleets
Every incident is somebody’s money. Usually it ends up being yours.
A driver files from their phone at the scene in about a minute. You get photographs, coordinates and the times the device recorded — and then a decision on who carries the cost, in writing, with a name on it.
Running in production today. Twenty minutes on a screen share, on your own data if you send a roster first.
Thursday, September 17
Morning, Marcus
Recent
Get the money back
Stop carrying costs that belong to somebody else
A damaged trailer, a customer's dock, a third party who drove off. Responsibility becomes a decision with an amount, a reason and a name against it — instead of a cost the company quietly absorbs because nobody ever wrote down whose it was.
What it is worth →Talk to your drivers
Run the fleet somewhere other than a text thread
Time off, pay questions, equipment, address changes, and the conversation about each incident. Asked, answered and decided in one place, where a reason is required and the record survives the person who wrote it.
How it works →Have it ready
The record exists before anybody asks for it
Every incident dated three ways, attributed to a person, photographed at the scene, and impossible to quietly revise afterwards — because the software itself is not permitted to rewrite its own history.
How that is enforced →On the phone
Seven screens, at the roadside, with gloves on
Seven for a backing incident; six when no vehicle is involved, because the category decides which questions get asked at all and nobody answers a form about a vehicle after a slip in the yard. Each screen asks one thing, which is how seven of them take about a minute. Every target is at least 48px, and the text is sized to be read in a cab.
Safety
When it happened
41.52519, −88.08173
Accurate to about 8 m
Where, in your words
You cannot change it after sending.
The part that matters at 2 a.m.
The report ID is minted when the form opens, not when it sends.
So when the signal drops halfway through and the driver presses send again — and they will — you get one report, not two. The office is never reconciling duplicates of the same collision, and the driver is never told their report failed when it did not.
What the record holds
Three timestamps, because they disagree
When it happened, when the device says it was reported, and when the server received it. A claim can turn on that gap, and a system that stores one number has already thrown the answer away.
A filed report cannot be edited by the driver who filed it. They can add photos and they can message the office, and both are recorded as what they are.
Internal notes stay internal. The office can write notes the driver never sees; the two threads are separate at the API, not merely hidden in the interface.
Cost is shown to the driver only once responsibility has actually been decided — not while it is still an open question with their name near it.
Thirty-five minutes between the device recording the report and the server receiving it. That is a driver in a dead spot on I-80, and it is a fact worth keeping rather than rounding away.
Cost recovery
Undetermined is not a status. It is a bill you have not sent.
Most of what a fleet absorbs belongs to somebody else — a customer's dock, a third party who drove off, their insurer. It gets absorbed because by the time anybody looks, the evidence has gone and the conversation never happened. Responsibility here is a field with five values, and one of them is a standing question until somebody answers it.
| Reference | Driver | Unit | Category | Severity | Status | Cost |
|---|---|---|---|---|---|---|
| INC-2026-0142 | M. Okonkwo | T-4471 | Backing incident | Moderate | Under review | Customer |
| INC-2026-0141 | P. Alvarez | T-3302 | Struck fixed object | Minor | Closed | Company |
| INC-2026-0139 | R. Whitfield | T-4108 | Collision | Critical | Awaiting info | Undetermined |
| INC-2026-0137 | M. Okonkwo | T-4471 | Roadside inspection | Minor | Closed | Company |
| INC-2026-0134 | D. Byrne | T-2290 | Near miss | Minor | Submitted | Undetermined |
The decision
Assigning cost should take a reason, not a click
So it is not a dropdown somebody flips on a Friday. It takes an amount and a written reason, and both are written to the audit trail with a name and a time. Six months later, when the customer argues — or a lawyer does — the answer exists and nobody has to remember it.
NAVYAX records the decision. It does not move money. Your office decides who carries a cost; what you then do about it — invoice the customer, claim on the insurer, absorb it, take it up with the driver — is your call and happens outside this software. There is no payroll deduction and no integration with your payroll system. Whether a cost can be passed to a driver at all is a question of federal and state law and of your own agreements — take your counsel’s advice, not ours.
The driver is not shown a cost while it is still undetermined. An open question with their name near it is not information, it is an accusation.
That paragraph is the difference between an invoice a customer pays and one they argue with. It is required, it is kept, and it cannot be edited afterwards.
Do the arithmetic
What is sitting in your undetermined column
Be honest about the percentage. Most carriers have never measured it, which is exactly the point — you cannot chase what you never counted.
That figure is what is owed, not what arrives. NAVYAX does not do the collecting — what it produces is the decision and the evidence behind it, which is the part that is usually missing when the collecting turns out to be impossible.
Cost a year that belongs to somebody
$34,650
A driver, a customer, a third party or their insurer. How much of it you actually collect is your business and your leverage — but every dollar of it needs a decision with a name, a date, an amount and the evidence behind it, and that is the part that usually does not exist.
Starting figures are a placeholder, not a benchmark. Put your own in.
Driver communication
The conversation stops living in somebody's personal phone
Time off, pay, equipment, address changes, and the back-and-forth about each incident. All of it asked and answered in one place, attached to the driver and the incident it belongs to.
Requests
New requestNov 24–28
$142.80
Load straps ×4
Oct 2–3
Why it was denied
Two drivers already off those dates at Joliet. Try Oct 9–10 and I'll approve it now. — Dana
INC-2026-0142
Backing incident
Dana Reyes · office · 9:06 AM
Can you get one more photo of the rear bumper, wide enough to show the dock plate behind it?
You · 9:12 AM
Added two just now.
Dana Reyes · office · 9:20 AM
That settles it — the plate was unsecured, so this goes to the customer, not to you.
Time off
Vacation, sick or personal, with the dates. Judged against the depot's local date rather than the server's, so a request filed at 11 p.m. in Oakland is not silently tomorrow. The reviewer sees who else is already off.
Pay question
The amount in dispute, the settlement reference or the pay period, and what they think is wrong. Money is held as an exact decimal, never a floating-point number that drifts a cent.
Equipment
What they need, how many, and whether it can wait. Straps, a jack, a replacement seal.
Update my details
Address, phone, emergency contact — and a free-text box for anything the list does not cover, which becomes required once they check it.
A denial requires a reason, and the driver reads it. That one rule removes most of the resentment, because “no” with a sentence attached is a decision and “no” on its own is a grievance.
Each type goes to the group that should see it. Pay questions to payroll, time off to dispatch. A driver’s pay dispute is not sitting in a queue the whole office reads.
Notes keep the name they were written under, so the record still makes sense after the person who wrote it has left. Internal office notes are never returned to the driver — that separation is in the API, not just hidden in the screen.
Said plainly
What this replaces is the text thread, not the phone call
Nothing is sent about an incident, a request or a decision — a driver sees a decision by opening the app, and the office sees a request by looking at the queue. Expirations are the one exception, and they do email you. The rest is on the roadmap below. What you get today is that none of it is in a text thread on a dispatcher’s personal phone, where it cannot be searched, cannot be handed over, and leaves when they do.
Getting started
Your roster arrives as the spreadsheet you already keep
Upload it and you get a preview, not a result. Every row is classified before anything is written, and nothing is applied until you say so.
1
Add
1
Update
1
Retire
1
No change
1
Cannot apply
| Sheet row | Name | Employee ref | What will happen |
|---|---|---|---|
| 4 | Okonkwo, Marcus | D-1042 | No change |
| 5 | Alvarez, Priya | D-1043 | Update |
| 6 | Santos, Elena | D-1147 | Add |
| 7 | Kowalski, Tomas | D-0884 | Retire |
| 8 | — | D-1043 | Cannot apply |
Row 8 — employee ref D-1043 appears twice in this file.
Errors are reported against your row numbers. Row 8 of your file is called row 8, so you can fix it in the spreadsheet still open on the other monitor.
Duplicates are caught both ways — against what is already in the system, and against the other rows of the same file, which is where they usually come from.
A round trip with no edits changes nothing. Export it, open it, close it, upload it: every row comes back marked “no change”. An import tool that cannot do that is one nobody trusts twice.
It goes back out, too. The roster exports as a real spreadsheet, dropdowns intact, whenever you want it.
DOT compliance
A lapsed medical card is a driver you cannot legally dispatch
And you usually find out on the day, from the driver, at six in the morning. The cost is not the violation — it is the load that did not move, the reshuffle, and a number on your record that takes two years to come off.
Most carriers run this on a spreadsheet somebody maintains by hand, and it works until that person is on vacation. The failure is never dramatic. It is one certificate nobody re-checked, found during an audit that was going fine until then.
This keeps the same record for every driver and every unit, judges each date in the depot’s own local time, and emails you at sixty days rather than on the morning it matters — then again at thirty, fourteen, seven and one, and only within the window you set for that requirement.
Straight answer
This is running now, with two limits worth knowing before the call. The FMCSA set is not seeded — you define the requirements you actually carry, which takes an afternoon. And existing credentials are entered rather than bulk imported, so moving a long spreadsheet across is work. Both are on the list.
- Requirements per driver and per unit — licenses, medical cards, MVR reviews, annual inspections, whatever else you carry
- A board that sorts worst first, so what is missing sits above what is merely expiring
- Email reminders at 60, 30, 14, 7 and 1 days, judged against each depot's local date
- Drivers photograph a renewal on their phone; the office approves or rejects it
- Every record keeps its whole chain — what replaced what, who voided it and why
- What a driver and unit held is written onto an incident as it stood that day
Where it joins the rest
An incident remembers what was current that day
Filing a report writes down what the driver and the unit held at that moment, as it stood. Six months later nobody has to reconstruct whether a medical card was in date — the answer was recorded when it was still true, and it survives the card being renewed and the requirement being retired.
Dates are judged where the driver is
Each depot carries a validated IANA time zone, and a reminder is measured against that local date rather than the server's. Expiry dates judged centrally are wrong twice a year, and wrong in the direction that puts somebody on the road who should not be.
A lapse does not always mean parked
Each requirement decides for itself whether letting it slip takes the driver or unit out of service. Expired and still in service is a real state that the system keeps as a real state, rather than flattening everything into one alarm nobody can act on.
The chain cannot be rewritten
Every record keeps what replaced what, who voided it and the reason they gave. Update and delete are revoked from the application at the database level, so the history an auditor asks for is the history that exists, not the one left after somebody tidied up.
Who can see what
Thirteen things a person can be allowed to do
Not a tier list with a Pro column. These are the actual permissions, and every one of them is checked by the system rather than assumed by the interface.
Permissions attach to groups, never to a person. So “why can she do that?” has exactly one answer, and it is a group you can look at.
Administrator cannot be granted or removed. It is implicit, which is what stops a company locking itself out of its own account at 5 p.m. on a Friday.
A refusal names the permission that was missing, so the person who hit it can tell an administrator what to turn on instead of filing a ticket that says “it says no”.
- IncidentsFile on behalf of a driver
- IncidentsProgress incidents
- IncidentsWithdraw a report
- IncidentsSet responsibility and cost
- IncidentsDelete a report permanently
- IncidentsWrite internal notes
- FleetEdit drivers and vehicles
- FleetDownload the roster
- FleetImport the roster by spreadsheet
- SettingsManage depots
- SettingsManage incident categories
- ComplianceRecord and renew expirations
- ComplianceDefine compliance requirements
How it is built
The boring parts, which are the ones that matter
Every line here is a mechanism rather than a promise, and each one is the kind of thing you can ask us to demonstrate on the call.
Isolation is the database's job, not ours
Every company's rows are separated by a policy inside PostgreSQL. A query that forgets its filter returns nothing at all — it cannot return somebody else's records, because there is no path by which it could.
The application's own database role owns nothing
PostgreSQL always lets a table's owner bypass isolation, so the role the software runs as owns no tables and is not permitted to bypass anything. Migrations use a different role entirely.
It refuses to start if isolation is not in force
On boot the service checks that it is not privileged, owns nothing, and that the policies exist. If any of that is wrong it stops. A misconfiguration takes the system down rather than quietly exposing it.
The audit trail is append-only at the database level
Update and delete are revoked from the application's own role on every history table. Not a policy we follow — a permission the software does not hold. It cannot rewrite what it wrote.
Every audit row names a person
A status change, a cost decision, a note: each carries who did it, when, and — where it was our support staff rather than yours — that it was ours, by name.
The part that holds your data has no public address
It is not firewalled off the internet; it is not on the internet. Nothing outside the private network can route to it, including us.
One more, quietly
Repeated failed sign-ins meet a cool-off that grows — and it is a cool-off rather than a lock, because an account anyone can lock by typing a known email address is a way to stop a driver filing a report at the roadside. A wrong password and an address that was never registered are indistinguishable from outside, so the sign-in page cannot be used to find out who works for you.
Integrations
Your TMS, ELD and dashcam
Connect the systems you already run so a report arrives with its context attached, instead of someone reconstructing it from three screens a week later.
Waiting on which TMS and ELD products you run. Connector effort depends entirely on the vendor — a documented API and a nightly file drop are weeks apart.
- Incident reporting from the driver's phone
- Cost recovery — responsibility, amount and written reason
- DOT expirations, with reminders before a credential lapses
- Driver requests — time off, pay, equipment, details
- Fleet roster import and export by spreadsheet
- Groups, permissions and the audit trail
- Notifications about incidents and requests (expirations already send)
- The FMCSA requirement set, seeded rather than entered by you
- Bulk import of existing credentials and their scans
- Exporting incidents (the roster exports today; incidents do not)
- Dashboards and reporting
- Offline drafts — filling the form needs no signal, sending it does
- TMS, ELD and dashcam integrations
No dates against these yet, deliberately. The order is being set with the fleets running it now, and a quarter invented to fill a column is worth nothing to you.
We would rather you read this here than discover it on the call. A vendor who only tells you what is missing once you have signed has told you something about the rest of the relationship.
How you start
There is no sign-up form, and that is deliberate
A fleet of forty trucks does not want to configure incident taxonomies on a trial account at nine at night. We set it up with you, and you are running inside a week.
- 01
A twenty-minute call
You tell us how incidents reach you today and where that breaks. We show you the product running, not a slide deck.
- 02
We set the account up
Your incident categories, your depots and their time zones. This is the part that takes thought, and it is the part that decides whether drivers use it.
- 03
We import your roster
From the spreadsheet you already keep. You see exactly what will be added, changed or retired before anything is written.
- 04
One terminal, one week
We create the logins and you run a single terminal before anyone else touches it. If it does not survive that week, it does not deserve the rest of your fleet.
Questions
The ones people actually ask
Does NAVYAX actually collect money from drivers or customers?
No. There is no payroll deduction, no invoicing and no insurer integration, and NAVYAX is not connected to your payroll system. Your office decides who carries a cost; NAVYAX records that decision — the amount, the written reason, and the photographs and timestamps behind it — audited and unrewritable. What you do about it afterwards is your call and happens outside this software: invoice the customer, claim on the insurer, absorb it, or take it up with the driver. Whether a cost can be charged to a driver at all is a question of federal and state law and of your own agreements; take your counsel's advice on that, not ours. The reason recovery usually fails is that the decision and the evidence never existed, and that is the part this fixes.
Is DOT compliance tracking working today?
Yes. You set the requirements your operation carries, against drivers and against units, and each one decides whether letting it lapse takes that driver or unit out of service. The board sorts worst first, so what is missing sits above what is merely expiring. The office is emailed at 60, 30, 14, 7 and 1 days, judged against each depot's local date. Drivers photograph a renewal on their phone and the office approves or rejects it, and every record keeps its chain — what replaced what, who voided it and why. Two honest limits: the FMCSA set is not seeded, so defining your requirements takes an afternoon, and existing credentials are entered rather than bulk imported, so moving a long spreadsheet across is real work. Both are on the list and we will say so on the call.
Will my drivers actually use it?
That is the right question, and it is why the driver side is seven short screens rather than one long form — each asks a single thing, which is how it still takes about a minute. The targets are sized for gloves, the camera opens on the rear lens, and a driver cannot be asked a question the category does not need. The honest risk is not the interface — it is that nobody told the drivers why. We set up one terminal for a week first for exactly that reason.
Does it notify anyone?
Expirations do. Nothing else does yet. The office is emailed before a credential lapses — at 60, 30, 14, 7 and 1 days, judged against the depot's local date. There is still no push and no SMS, and nothing is sent about an incident, a request or a decision: a driver sees a decision by opening the app, and the office sees a new request by looking at the queue. The only other mail the system sends is a driver's sign-in link. That remaining gap is real and it is on the list. What you get today is that none of it is in a text thread on a dispatcher's personal phone, where it cannot be searched or handed over and leaves when they do.
What does it cost?
Per truck per month, with a floor for small fleets. We quote on the call because the number depends on your fleet size and how many terminals you run, and we would rather fit it to your operation than publish a tier that fits nobody. Ask on the call and you will get a figure, not a brochure.
Does the driver have to install anything?
No. They open a link and sign in. It is built for a phone — 48px targets you can hit with gloves on, the rear camera for photos, and text large enough to read in a cab — but there is nothing to download and nothing to update.
What happens if the driver has no signal?
The form fills in fine, but sending it needs a connection. What the signal cannot break is the report identity: it is minted when the form opens, so if the send drops and they try again you get one report, not two. Saved offline drafts are on the roadmap and not here yet — we would rather say so than have you find out at a weigh station.
Where does our data live, and who can see it?
In the United States, in a private network with no public address on the part of the system that holds it. Separation between companies is enforced by the database itself rather than by application code, and it fails closed — a query that forgets its filter returns nothing at all. Inside your account, what each person can see is decided by the groups you put them in.
Can NAVYAX staff see our incidents?
Only by entering your account, which requires a typed reason, shows a black banner across the interface the whole time they are in, and writes their name onto everything they touch. There is a log of who entered, when, and why. Support can read driver requests but cannot decide them — that is your staff's call, and the system refuses it.
Can we get our data back out?
The driver and vehicle roster exports to a spreadsheet, with the dropdowns intact, whenever you want it. A full incident export is on the roadmap and not built yet. If you leave, we will hand you the data.
Do you integrate with our ELD or TMS?
Not yet, and the honest answer is that it depends entirely on the vendor — a documented API and a nightly file drop are weeks apart in effort. Tell us what you run and we will tell you which it is.
How long does it take to get started?
A week, most of which is you deciding your incident categories. We set the account up, import the roster from the spreadsheet you already keep, and create the logins. Run one terminal for a week before anyone else touches it.
Do your drivers get it in Spanish?
Not yet — the driver side is English only today. It is on the list, and it matters more than most of what is on there, because a form a driver half-understands produces a report you cannot rely on. If a large share of your drivers would use Spanish, say so on the call: it moves up the order, and the fleets running it now are the ones setting that order.
Who is behind this?
A small, independent company registered in Maryland. You will deal with the person who built the thing. At this size that means the roadmap is genuinely shaped by the first few fleets on it — which is the reason to be one of them.
Book a demo
Twenty minutes, on your own data if you want
Send a roster beforehand and we will import it first, so what you are looking at is your fleet rather than a made-up one.
You will get a reply from a person, usually the same day. There is no sequence, no sales team and no follow-up drip — there is one of us.
If you would rather just email, hello@navyax.com reaches the same place.