RecallPilot: A Recall Management Software Platform Built From Recall Data

RecallPilot is Dude Lemon’s product recall software platform. It is the consumer-facing recall website on a brand’s own domain, the eligibility lookup behind it, the registration, claims, and remedy workflows, and the recall management console that runs the programme. It is deployed and customised per client, it extends recall platforms clients already run, and it has been proven on a worldwide automotive steering recall and a nationwide medical device programme.

This post is not a feature list. The RecallPilot page has forty-plus features and twenty FAQs. This is the reasoning: seven design decisions, each anchored to a published number about how recalls actually go, and then a section on which of our own numbers are observed and which are engineered, because that distinction is where recall vendors are least honest.

1. The website is the primary channel, not a supporting one

Most recall plans treat the website as the place the press release points to. The data says it is the channel that keeps working after the press release stops. In a CPSC staff report to Congress, a manufacturer that reached about 60% of affected consumers directly through registration and customer records analysed the other 40%, who found the recall on their own. Of those, 82% learned about it from the recall website, 5% from a retail store poster, 2.4% from television, and 1.6% from print and radio combined. The same report notes that mass-media reach peaks shortly after the announcement and decays, while websites remain the better channel for long-term communication, especially with second-hand owners.

Scale confirms it. The free open-recall search built by the Alliance for Automotive Innovation and CARFAX has checked US vehicles more than 10 billion times since 2018. People look things up. So RecallPilot is built as a website first: the lookup is the product, everything else supports it, and the site runs on the client’s domain or a dedicated recall subdomain because a consumer who has just been told to act by a press release will not trust a URL they have never seen.

2. It is built for the hour after the announcement

On 21 October 2014, NHTSA expanded the Takata airbag recall to almost 8 million vehicles and urged drivers to check their VIN at safercar.gov. The VIN lookup tool crashed that morning and was still down that night. That is the shape of every recall launch: the busiest hour of the entire programme is the first one, and it is the hour when an outage does the most damage to trust.

The spike also looks like an attack from the edge, and real attacks are larger every year. Cloudflare reported 47.1 million DDoS attacks mitigated in 2025, a 121% increase, averaging 5,376 attacks an hour, with a record 31.4 terabit-per-second attack in the fourth quarter. RecallPilot therefore runs behind unmetered DDoS mitigation with no attack-size ceiling and no surge billing, a managed web application firewall with rules written for lookup and claim endpoints, and edge caching that keeps the dynamic surface small. The platform has handled more than one million requests a minute in edge load testing, and each launch is additionally tested against the traffic profile agreed with the client before DNS cuts over.

3. The lookup returns three answers, and it is fast

A recall lookup has three outcomes, not two: affected, not affected, and cannot determine. The third is the one that decides contact-centre volume. In the CPSC’s study of durable infant product recalls, consumer inquiries reached about 25% of products estimated to be in use, and much of that volume is people who could not get a confident answer online. RecallPilot handles the third outcome as its own path, with guided identification showing where a code is printed, a photo fallback, and a review queue, rather than collapsing it into "not affected".

The identifier itself is where most recall sites go wrong. A VIN carries a check digit, so a mistyped VIN can be caught before it returns a false negative. A serial number has a format but no checksum. A lot code frequently maps to a production window, which makes the lookup a date-range query. RecallPilot supports eight-plus identifier types (VIN, serial, model, SKU, IMEI, batch, lot, and date code), with versioned rules that combine identifiers with manufacturing ranges, purchase dates, geography, and explicit inclusions and exclusions. On the automotive programme, the lookup averaged 600 milliseconds per query under enumeration defence, which is the delivered figure in the case study.

4. The lookup is defended as an oracle

Ask a lookup about an identifier and it tells you whether that identifier is in the affected set. That is the purpose of the page and also its vulnerability: an undefended endpoint lets an attacker walk the identifier space and reconstruct the affected-product list, which for vehicles is close to a list of identifiable owners and for consumer goods is commercially sensitive volume data. This was an explicit client requirement on the automotive programme.

RecallPilot’s defence is layered because every single measure is defeatable on its own: rate limits per IP, per session, per identifier, and per endpoint; exponential backoff; sequential-pattern detection; bot challenges that escalate only for suspicious sessions; and response shaping so a hit and a miss are indistinguishable in timing and payload size. Every portal is penetration tested by the same team that runs our security audit practice before it takes traffic.

5. It instruments completion, not just registration

The most under-reported number in the recall industry is the share of affected consumers who actually finish the remedy. Figures presented at the CPSC’s 2017 Recall Effectiveness Workshop put it at roughly 6% on average across product types, around 4% for items under $20 and about 32% for items at $10,000 or more. Consumer Reports’ national survey found only 21% of Americans had heard of a recall on a product they owned and acted on it in five years. Vehicles are the best case, and even there NHTSA’s report to Congress puts the average completion rate near 75%, falling to 44% for vehicles five to ten years old; CARFAX counted 58.1 million US vehicles with an open recall in January 2025.

Two things in the data move completion. Registration data is one: after NHTSA required child-seat registration cards, the share of registered seats rose from 3% to an average of 27%, and the repair rate rose from 13.8% to 21.5%. Friction is the other: a remedy that requires a receipt the consumer has to go and find is abandoned unless they can come back to it. So RecallPilot captures effectiveness data as the programme runs rather than reconstructing it afterwards, tracks remedy status end to end (dispatch, carrier tracking, return receipt, repair completion, payment), splits long forms into saved stages with signed save-and-resume links, and reports funnel drop-off in the console so the recall lead can see where consumers are being lost.

6. Accessibility and regional deployment are defaults, not options

A recall site is the one page a company most needs every affected person to be able to use, and it is also a legal exposure. Seyfarth Shaw counted 3,117 federal website accessibility lawsuits in 2025, up 27% on 2024, with more than 5,000 including state courts according to UsableNet. RecallPilot is built to WCAG 2.2 AA across the complete consumer journey, which is the standard ADA Title III and Section 508 claims are measured against and the basis of the European Accessibility Act.

Regions are treated as separate recalls. The EU’s Safety Gate logged a record 4,671 alerts in 2025, its national authorities took 5,794 enforcement actions, and EU consumer data carries residency rules that US infrastructure does not satisfy. RecallPilot deploys per region on independent infrastructure, with storage, processing, backups, and logs pinned to the region, and both regions go live in the same window. This is simple on day one and painful to retrofit once a portal holds real records.

7. It connects to the systems that already hold the truth

The affected-product list does not originate in a recall tool. It lives in the ERP, the QMS, and the MES, and the recall record should be read from those systems rather than re-keyed into a spreadsheet that drifts. RecallPilot’s traceability module covers forward and backward batch and lot genealogy, one-up one-back records structured for FSMA Section 204 (compliance now due July 20, 2028), CAPA workflow with root cause and effectiveness verification, bidirectional ERP integration with SAP, Oracle, Microsoft Dynamics, and NetSuite, QMS and MES connections, distributor and supplier workflows, and timed mock recall exercises that produce the reconciliation percentage an auditor expects.

It also works the other way. Where a client already runs a recall platform, RecallPilot sits over it as a branded consumer front end, adds custom modules and workflow extensions, or white-labels a third-party backend. Most enterprise recall work is not greenfield, and a platform that can only start from zero is solving the wrong problem.

Delivered versus engineered: how we report our numbers

Recall vendors blur two kinds of figure: what was observed on a real programme, and what the platform is built to take. We keep them apart in every document, including this one.

Ways to work with RecallPilot

• Custom recall portal build: a new consumer recall website and operations console on your domain, live in production in under 24 hours once intake is complete, then operated with you through expansions.
• Extend an existing platform: keep the recall management software, ERP, or quality system you already run and add a branded consumer portal, custom modules, or a white-label front end over a third-party backend.
• Integration and modernisation: connect the portal to CRM, ERP, warehouse, contact-centre, fulfilment, and payment systems, replace a static recall page with a working lookup, or bring an ageing portal up to current security and accessibility standards.

Frequently asked questions

The full capability list is on the RecallPilot page. For how it compares with other platforms, read the best recall management software in 2026, and for the build itself, how we ship a recall portal in under 24 hours. If you have an announcement date, talk to us before it.