Security Controls
55 safeguards monitored across our infrastructure and processes, grouped by the area they govern.
CJIS controls
Controls aligned to the FBI CJIS Security Policy for environments where criminal justice information is in scope.
CAD- and RMS-derived records are treated as CJI unless affirmatively determined otherwise.
Storage, processing, and inference remain in US regions within our cloud environment.
TLS with FIPS-validated endpoints on the CJI path.
Data at rest is encrypted with keys held in the cloud key management service.
No other personnel, including leadership, hold credentials to systems containing CJI.
State and national checks completed through each agency's state process.
Required for personnel with CJI access and repeated on the required cycle.
The Attorney General-approved addendum is signed for each agency engagement.
Every access to a CJI-classed record is captured in an immutable audit trail.
Notifications carry links into the authenticated application, never record content.
Inference runs inside our cloud boundary rather than at an external AI provider.
Access Management
Who can reach production, and on whose approval.
Access is granted at the minimum scope needed for a role.
Application permissions are derived from assigned roles, not per-user grants.
Production and administrative access is reviewed on a fixed cadence.
New access requires documented approval before provisioning.
Access is revoked across systems on the last day of employment.
Shared logins are prohibited; every actor is individually attributable.
Customer data is scoped by organization at every read and write path.
Administrative access requires authenticated, encrypted sessions.
Infrastructure Security
How the platform and its network are built and defended.
All external traffic is served over TLS with modern cipher suites.
Databases, object storage, and backups are encrypted at rest.
Application, data, and management tiers are separated.
Inbound access is denied by default and opened by explicit rule.
Automated backups are taken and restores are exercised.
Environments are declared in version-controlled configuration.
An independent assessor tests the platform and findings are tracked to closure.
Change Management
How code reaches production without surprises.
Changes to production code require review by another engineer.
Direct pushes to release branches are blocked.
Type checks and tests must pass before a change can merge.
Every deployment maps to an identifiable commit.
A documented path exists to revert a bad release quickly.
Development and production are isolated from each other.
Credential Handling
How secrets and identities are protected.
MFA is enforced for administrative and production access.
Credentials are held in a managed secret store, never in source.
Repositories are scanned for committed credentials.
Account passwords are stored using a modern one-way hash.
Keys are scoped to an organization and can be rotated or revoked.
Authenticated sessions expire and can be terminated centrally.
System Configuration
Hardened defaults across endpoints and services.
Services are deployed from reviewed, hardened configurations.
Company workstations enforce full-disk encryption.
Workstations lock automatically after inactivity.
Operating systems and dependencies are kept current.
Third-party packages are scanned and upgraded on findings.
Applications set CSP, HSTS, and frame protections.
Monitoring
What is watched, recorded, and reviewed.
Application and infrastructure logs are aggregated.
Security-relevant actions are recorded with actor and timestamp.
Uptime and error rates are monitored continuously.
Alerts route to a responsible on-call engineer.
Logs are retained for the period set by policy.
Unusual administrative access is surfaced for review.
Incident Response
What happens when something goes wrong.
Roles, severities, and escalation paths are defined in advance.
Incidents are triaged against a documented severity scale.
Affected customers are notified within contractual timelines.
Every significant incident gets a written retrospective.
The response plan is tested and updated at least annually.