Trust Passport

Inspiration

On most platforms, reviews only run one way. Guests review hosts, but the host letting a stranger into their home, or the driver picking up an unknown rider, gets little back. The side taking the real physical and financial risk is often flying blind, especially with first-time guests who have no history at all.

Real-world pains are everywhere. Homestay hosts frequently deal with guests destroying property, trash-filled rooms, and broken antique heirlooms. Similarly, self-drive car rental owners (such as on Turo or Getaround) suffer from guests abusing vehicles, returning them dirty and damaged, while platform support remains slow to respond.

Reputation is also trapped on each platform. As platform fees climb (e.g., Airbnb up to 15.5%), hosts are shifting to direct bookings—which grew roughly 90% in a year. But the moment a host goes direct, they lose the review history that made them trustworthy. Trying to "carry your stars across apps" is a known startup graveyard (Deemly, Traity) because imported ratings carry little weight.

Our fix: Stop trying to move raw stars. Instead, let the worried party simply ask for proof, on demand, via a "vet link" right when a transaction is about to happen.

What it does

Trust Passport turns reputation into an on-demand trust request.

• On-Demand Vetting Links: Any host, seller, or landlord can instantly create a custom vet link (e.g., /vet/<token>) requesting a specific trust level (e.g., Gold Homestay) and preferred disclosure depth. Requesters don’t even need an account to ask.
• Privacy-Preserving Proof: The user being vetted signs in, connects their platforms (Airbnb, Booking.com, Uber, Turo, eBay, etc.), and consents to a disclosure depth (Minimal, Standard, or Detailed).
• Anonymous Trust Stamps: The requester gets a clear Pass/Fail against their minimum required level and aggregate trust metrics (number of events, track record, confidence) but never sees the person's name, email, or specific platforms connected.
• Unified Review History: When hosts connect their history, unreviewed past stays surface as stays they can review on Trust Passport. Once those guests link their own accounts, these reviews automatically attach to them using privacy-safe hashed identifiers.

How we built it

The front end was scaffolded with v0, which helped us connect to AWS using IAM access and almost single-shotted the entire application interface and schema after we submitted a highly detailed plan.

From there, we transitioned to Claude for fine-tuning, system integration, and logical feature fixing. Every platform and scoring area is structured as a modular config file, making it incredibly simple to add new integrations. Trust events are append-only, stamps are recomputed by a background job, and schema changes run automatically on production deploys.

Architecture

+------------------+        +------------------+
| Requester        |        | Passport holder  |
| creates vet link |        | signs in, consents|
+--------+---------+        +---------+--------+
         |                            |
         +------------+---------------+
                      v
          +-----------+------------+
          | Next.js app on Vercel  |
          | UI, auth, consent,     |
          | sharing, API handlers  |
          +-----------+------------+
                      |
          +-----------+------------+
          | Data ingestion layer   |
          | eBay OAuth + Airbnb,   |
          | Uber, Turo uploads     |
          +-----------+------------+
                      |
                      v
          +-----------+------------+
          | Amazon Aurora PG       |
          | IAM via RDS Signer     |
          | subjects, sessions,    |
          | connections, events,   |
          | reviews, stamps, links |
          +-----------+------------+
                      |
                      v
          +-----------+------------+
          | In-app job runner      |
          | append events, match   |
          | reviews, recompute     |
          | domain stamps          |
          +-----------+------------+
                      |
                      v
          +-----------+------------+
          | Public passport        |
          | anonymous trust stamp  |
          | + aggregate context    |
          +------------------------+

Raw platform tokens, emails, reservation details, and platform identities stay server-side; public links expose only scoped aggregate stamp data.

Accomplishments that we're proud of

• Privacy-First Email Matching: To match peer reviews to anonymous subjects without storing cleartext emails, the system normalizes and matches users using secure, salted SHA-256 HMAC hashes.
• Recency-Weighted Scoring Engine: Built a unified scoring function (computeStamp) that weights events by source and applies a multiplier for events in the last 12 months.
• Immutable Append-Only Trust Ledger: Trust events are completely immutable and unique , ensuring a secure, tamper-proof, and audit-friendly reputation log.
• Privacy-Preserving LLM Summarization: We leverage Gemini to write natural-language confidence summaries. Using strict JSON schemas, the prompt restricts Gemini to aggregate public statistics, preventing any potential leak of private user details.

What's next for Trust Passport

• Autofill a profile on sign in, so people connect an account instead of uploading a data export.
• The off platform wedge, plus a B2B vetting API for independent hosts and landlords.
• Native integrations, so a host can launch a vet request straight from the platforms they already work in.
• Pricing that can flex with a verified profile, rewarding trust and pricing in risk.
• Gaming resistance: W3C Verifiable Credentials, non transferable (soulbound) attestations, and a vouch system.
• More connectors, and time based trust ("verified history spanning…") as a first class signal.

Built With

• aws-aurora-postgresql
• vercel