NEW DELHI, October 28, 2026 — The Unified Logistics Interface Platform (ULIP) has rejected allegations that it supplied unmasked vehicle records, saying its system relays data exactly as received from government source APIs. The Road Ministry has sought an audit of entities accessing the platform after complaints that apps and websites were selling vehicle information, including cases of unusually large-scale data extraction.
ULIP said vehicle-owner names, chassis numbers and engine numbers retain their masking, while mobile-number fields remain null in both the source and user-facing responses. The platform said it does not generate, unmask or enrich the underlying data.
What ULIP says its system delivers
ULIP said access is governed by entity screening, proposed-use-case reviews, contractual conditions, IP whitelisting, phased onboarding and continuous monitoring of API activity. The platform operates within the Road Ministry’s policy for sharing data from the National Transport Repository, which requires authentication, secret keys, masking of personally identifiable information and defined approval procedures.
The ministry shares transport-related information with government agencies and private companies through systems including VAHAN, SARATHI, e-Challan and the Pollution Under Control Certificate portal. ULIP’s position is that any unmasked information appearing elsewhere requires examination beyond the platform itself.
"The wider ecosystem of platforms and channels through which such information is being made available needs scrutiny."
Why the ministry has ordered further checks
The Road Ministry sought an audit after identifying entities that were extracting data from ULIP in large volumes. Some users were reportedly pulling as many as 50 lakh records a month, raising questions about whether approved access was being used for purposes beyond the stated use cases.
The ministry has also written to the Indian Computer Emergency Response Team, or CERT-In, seeking a forensic audit of VAHAN, SARATHI, e-Challan and the PUCC system. The move shifts the focus from ULIP’s own data-handling controls to the complete chain of access, extraction and possible onward distribution.
What the safeguards mean for the public
Masking is intended to prevent direct exposure of personally identifiable information while allowing approved services to use limited vehicle records. It does not, by itself, establish how information found on third-party platforms was obtained or whether separate datasets were combined to identify individuals.
For vehicle owners, the immediate concern is the possible sale or circulation of information linked to registration records. The ministry’s audit process should clarify which entities accessed the systems, what volumes they retrieved, whether their usage matched approved purposes and whether any security or policy breach occurred.
| Key Metric / Entity | Verified Detail | Strategic Impact |
|---|---|---|
| ULIP data response | Owner names, chassis and engine numbers remain masked; mobile numbers remain null | Limits direct exposure of personal identifiers through the platform response |
| Reported extraction volume | Some entities pulled as many as 50 lakh records a month | Prompts examination of bulk access and approved use cases |
| Government systems under review | VAHAN, SARATHI, e-Challan and PUCC portals | Broadens the inquiry across the transport-data chain |
| Investigating agency | CERT-In has been asked to conduct a forensic audit | Could identify access patterns, weaknesses or unauthorised activity |
What happens next
CERT-In’s forensic review and the Road Ministry’s user audit are the next confirmed procedural steps. Their findings may determine whether the issue involved misuse by authorised users, weaknesses in connected government systems, or the circulation of data obtained through other channels.
ULIP has called for scrutiny of the broader network of apps, websites and other channels that allegedly make vehicle information available. Until the audits establish the source and handling of any exposed records, the confirmed position is narrower: ULIP says its own responses preserve the masking applied by source systems.
