Product recall engineering
Product Recall Portals and Recall Websites, Live in Under 24 Hours
We build the consumer-facing website at the centre of a product recall: lookup, eligibility, registration, reimbursement, and the security to survive the traffic and the attackers that arrive with it. Fortune 500 brands have run recall programmes on portals we engineered.
A recall is a deadline, not a project. The moment a regulator notice goes out or a press release lands, every affected customer arrives at once, looking for one thing: am I affected, and what do I do now. If the website is not there, the call centre absorbs the entire volume and the recall gets more expensive by the hour.
Most recall vendors handle logistics, retrieval, and contact centres. The website is usually an afterthought, subcontracted late and built to a template. We do the opposite. We build the portal as the primary channel, engineered to enterprise standards, and we get it into production in under 24 hours once you have supplied your content and the affected-product data.
Deployment
Under 24 hours, and what that actually means
Under 24 hours means fully live with your content, on your domain, in production, ready to take real consumer traffic. It is not a staging link and it is not a placeholder page. The clock depends on one thing on your side: you supplying the recall copy, the affected-product data, and DNS access. Everything else is ours.
Intake
Recall scope, affected product identifiers, remedy type, regulator involved, target markets, and the domain you want it on.
Build
Lookup logic against your affected-product data, registration form, remedy flow, and copy in every language the recall covers.
Harden
WAF rules, rate limits, enumeration defence, bot filtering, and a load test against the traffic spike the announcement will create.
Review
Your legal, brand, and regulatory sign-off on a live staging URL, with revisions turned around in the same session.
Live
DNS cutover to your domain, TLS issued, monitoring and alerting armed, and the portal is taking real traffic.
If your recall spans the US and the EU, both deployments go live in the same window on separate infrastructure. See the data residency section below.
Consumer experience
Product lookup that matches how your products are actually identified
The lookup is the whole portal. Get it wrong and consumers either cannot tell whether they are affected, or they conclude they are not when they are. We build the lookup around your identifier scheme, not a generic search box.
VIN lookup
Vehicle identification number entry with checksum validation, so typos are caught before they return a false negative. Used on a worldwide steering recall we engineered for a global automotive manufacturer.
Serial and model number lookup
Serial, model, SKU, IMEI, or asset tag, validated against your affected-product list with format hints and inline correction when the consumer mistypes.
Batch, lot, and date code lookup
The standard identifier for food, pharmaceutical, and consumer packaged goods recalls, including date-range matching where a lot code maps to a production window rather than a single value.
Photo-assisted identification
When a consumer cannot find the code, a guided flow shows exactly where it is printed on that product, with reference photography and a fallback upload path.
Identity matching registration
Where the affected population is already known, consumers are matched against your records by name, address, and contact details rather than a product code. Built for a nationwide medical device recall programme.
Verified owner login
Accounts with email or SMS verification when a recall runs long enough that consumers need to return, check status, or complete a multi-stage claim across several sessions.
Ambiguous and negative results handled properly
A clear, plain-language result for affected, not affected, and cannot determine, each with its own next step. The third case is the one most recall sites get wrong.
Consumer status tracking
A reference number and a status page so consumers can check progress without calling, which is what actually reduces contact centre volume.
Registration and remedy
Custom registration and submission forms
Every recall has a different remedy: repair, replace, refund, retrofit, collect, or destroy in place. The form has to match the remedy, and it has to change without a rebuild when the programme changes mid-flight.
Multi-stage encrypted registration
Long forms split into stages with progress saved between them, so a consumer who abandons on step three does not restart from step one.
Conditional logic
Fields, branches, and entire steps that appear based on product, market, remedy choice, or answers already given. One portal serves several affected models without confusing anyone.
Document and photo upload
Proof of purchase, serial plate photographs, date code images, and damage evidence, with virus scanning, type and size validation, and image compression on the client before upload.
Reimbursement and claims
Expense claims, receipt capture, banking or payment details collected under encryption, approval workflow, and payment status visible to the consumer. Most recall vendors do not market this at all.
Address validation
Verified, deliverable addresses at the point of entry, so replacement units and return labels do not fail later at the warehouse.
Return logistics
Prepaid return label generation, carrier integration, and collection booking where the remedy requires the product to come back.
Duplicate and fraud detection
Detection of repeat submissions across identifier, address, device, and payment detail, so a single household cannot claim a hundred remedies.
Save and resume
A signed resume link sent by email so a consumer who needs to go and find a receipt can come back to a part-completed claim.
Security engineering
A recall portal is a target the day it launches
A recall portal is a public database of your affected products with a form that accepts personal data, announced by press release. It attracts scrapers, enumeration attempts, fraudulent claim volume, and opportunistic attacks. We assume all four from the first deploy.
Enumeration attack protection
A naive lookup lets an attacker walk the identifier space and reconstruct your entire affected-product list, or confirm which VINs and serials exist. We defend with per-identifier and per-client rate limits, exponential backoff, response shaping so hits and misses cost the same, and blocking on sequential-pattern detection.
DDoS protection
Edge absorption in front of the origin, with volumetric and application-layer mitigation. A recall announcement and a denial-of-service attack look similar at the edge, so the rules are tuned to shed attack traffic while letting a genuine flood of consumers through.
Web application firewall
A managed WAF ruleset plus rules written for the specific portal, covering injection, cross-site scripting, path traversal, and abuse patterns particular to lookup and claim endpoints.
Bot detection and challenge
Automated traffic separated from real consumers, with challenges escalating only for suspicious sessions so legitimate users are never made to prove they are human.
Rate limiting in layers
Limits applied per IP, per session, per identifier, and per endpoint, because a single-dimension limit is trivially defeated by a distributed scraper.
Encryption in transit and at rest
TLS on every hop, encrypted storage for personal data, and encrypted transfer into your own systems so the portal is never the long-term home of consumer records.
Audit logging
Tamper-evident logs of access and administrative action, retained and exportable on demand. Built for a client who required encrypted audit logs delivered on request.
Data retention and purge
Retention windows set per market and enforced automatically, with verifiable purge at the end of the programme rather than data sitting on a server indefinitely.
Penetration tested
Security review and testing before launch, by the same team that runs our security audit practice, with findings fixed before the portal takes traffic.
Infrastructure
Custom domain, and separate deployments per market
A recall that crosses borders is not one recall. The regulator differs, the remedy differs, the languages differ, and the rules about where consumer data may be stored differ. We deploy per market rather than bolting a language switcher onto one server.
Your own domain
The portal runs on your domain or a dedicated recall subdomain, with TLS issued and auto-renewing. Consumers who have just been told to act by a press release will not trust an unfamiliar third-party URL, and neither will your legal team.
Separate US and EU deployments
Independent infrastructure per region, so European consumer data stays in European infrastructure and never transits US systems. Both go live in the same window.
Data residency
Storage, processing, backups, and logs pinned to the region, so a data protection question has a clear and documented answer.
GDPR and CCPA handling
Lawful basis documented, consent captured where required, and subject access, correction, and erasure requests supported as a working flow rather than an email address.
Built for the announcement spike
Load tested against the traffic the announcement will actually create, with autoscaling and static edge caching so the portal does not fall over in the first hour, which is the hour that matters.
Monitoring and alerting
Uptime, error rate, submission success rate, and lookup latency monitored from launch, with alerting to a named person rather than an unread inbox.
Multi-language and locale
Every market in its own language, with locale-correct dates, addresses, phone formats, and units, reviewed by your local teams before launch.
Accessibility
Built to WCAG 2.2 AA. A recall notice has to reach everyone affected, including consumers using screen readers, and in several jurisdictions that is a legal requirement rather than a preference.
Programme operations
What your team and your regulator get
The consumer-facing site is half the system. The other half is what your recall team, your contact centre, and your regulator need out of it, ideally without anyone exporting a spreadsheet by hand at midnight.
Administration dashboard
Live registration volume, remedy mix, geographic spread, and completion rates, so the programme is managed on current numbers rather than last week's report.
Regulator reporting
Reporting shaped to what the CPSC, FDA, NHTSA, or the relevant EU authority expects, exported on the cadence the recall requires.
Recall effectiveness data
The response and completion figures that effectiveness checks depend on, captured as the programme runs rather than reconstructed afterwards.
Contact centre integration
Agents see the same record the consumer sees, and can complete a registration on the phone for consumers who will not or cannot use the site.
Consumer notifications
Email and SMS at registration, approval, dispatch, and completion, which is what stops consumers phoning to ask what is happening.
Data delivery to your systems
Scheduled encrypted transfer into your CRM, warehouse, or data platform, in the format your systems already accept.
Single sign-on
Your staff and your vendors access the admin side through your identity provider, with role-based permissions and no shared logins.
Analytics
Where consumers drop out of the funnel, which is usually the difference between a recall that reaches its completion target and one that does not.
How we hit the window
AI-assisted build, human-owned engineering
Under 24 hours is only possible because we do not start from zero and we do not hand-write the parts that should not be hand-written. What AI does not do is decide the security model.
A hardened starting point
Lookup, multi-stage forms, uploads, notifications, admin, and the security layer already exist as a tested foundation. Each recall configures and extends it rather than rebuilding it.
AI on the mechanical work
Form scaffolding, validation rules, locale files, translation drafts, test data, and content variants are generated and then reviewed, which removes most of the hours that used to sit between intake and staging.
AI-assisted review
Automated review across accessibility, copy consistency, and validation coverage catches the class of mistake that a compressed timeline normally introduces.
Engineers own security and correctness
Lookup logic, the enumeration threat model, WAF rules, encryption, and data residency are designed and signed off by engineers. Generated code does not go to production unreviewed, and a recall portal is not the place to find out otherwise.
Case Studies
Recall programmes we have engineered
A secure recall portal for a global automaker
A secure portal built for a global automotive manufacturer headquartered in Germany during a worldwide steering recall: owners check eligibility by VIN, verify their identity, and complete an encrypted multi-stage registration, hardened against VIN enumeration.
A nationwide patient portal, built from the ground up
A three-year engagement building the US patient portal for a major medical technology brand: identity-matching registration, medical-grade data security, and encrypted audit logs delivered on demand.
FAQ
Questions, answered
Related reading
Go deeper on recall engineering
Recall announcement already scheduled?
Tell us the announcement date, the affected products, and the markets. If you have the content and the data ready, the portal is live on your domain in under 24 hours.