Security
Policepen holds criminal justice information. It is built to the FBI CJIS Security Policy v6.1, and we sign the CJIS Security Addendum with each agency.
Sign-in and access
Every user signs in with a password and an authenticator code. Five failed attempts in 15 minutes lock the account until an agency admin releases it. Sessions lock after 30 minutes idle and require a full sign-in every 12 hours. Signing a report asks for the password again.
Encryption
Case content is encrypted with AES-256 under a key that belongs to your agency alone, held in AWS Key Management Service (FIPS 140-3 validated). Data in transit uses TLS 1.2 or later.
Hosting
Production runs in AWS in the United States (us-east-1). No one at Policepen has console or shell access to the production database. Emergency access needs your agency's written approval, is time-limited and is logged.
Audit
Every read and every change of case content is recorded with who, when and from which device. The audit log cannot be edited and is kept for at least one year.
Phones
The iPhone app runs only on devices your agency manages with MDM. Recordings are encrypted on the phone. Push notifications never contain case information. A phone your agency removes uploads its pending work and then erases case data.
AI and your data
Transcription and fact extraction run inside our AWS account. Your agency's data is never used to train any model. Nothing becomes a fact until an officer confirms it, and the narrative is drafted only from confirmed facts.
People
Everyone at Policepen with access to criminal justice information passes fingerprint-based background screening and completes security awareness training.
Incidents
Security incidents are reported internally within one hour of discovery and escalated to your agency and the CJIS Systems Officer under the CJIS Security Policy.
Documents for your review
Security overview, CJIS control matrix, policies, MSA, DPA and the CJIS Security Addendum signature page are available on request.