Security

Fire departments trust us with reports, case files and personnel records. Here is how we protect them. We say what we do. We never name a certification, audit or program we do not hold.

What we do

• Your agency owns its data. Your records belong to your agency. We do not sell them and we do not use them for advertising. You can export your data at any time, and if you leave we return it and delete our copy.
• One agency can never see another. Every record is tied to one agency and the database itself blocks any request from outside that agency.
• People see only what their role allows. Members see their own work. Officers see their crew. Chiefs see the department. Sensitive case files can be limited to named people only, and agency admins are not exempt. Access is decided on the server, per role and per record. Hiding a button is not security, so we never rely on it.
• Everything important is logged. Every sign in, view of a restricted file, edit, export and access change is recorded with who, what and when. The log cannot be edited or deleted.
• Originals are never altered. Photos, video and documents are fingerprinted the moment they arrive. The original is stored once and never changed. Every copy points back to it.
• Encrypted coming and going. All traffic is encrypted in transit and data is encrypted where it is stored. Hosted in the United States, with each agency's records isolated from every other agency's.
• Built for shared station computers. Sessions end after a period without activity. Nothing is left on screen or in the browser after sign out.
• Sign in with your city's own Microsoft or Google account is planned, with two step sign in for sensitive roles.

What we never do

• Sell agency records or use them for advertising.
• Use agency records to train general purpose artificial intelligence models.
• Hold records hostage. Export everything, any time, in open formats, and for 60 days after you leave. A billing dispute never cuts off access.

Patient records and criminal justice information

Agencies that keep patient care records or criminal justice information sign the matching exhibits with the subscription agreement: a business associate agreement for patient privacy, and the criminal justice security addendum. Breach notice comes within 72 hours, and within 24 hours for criminal justice information.

What we claim

Only what is true. We never claim a certification we do not hold. When an agency needs a security questionnaire answered, we answer it in writing. Ask us for our current security summary. We will tell you plainly what is in place today and what is scheduled.

Report a security problem

Email security@brassacre.com or call (866) 342 7277. This site also serves /.well-known/security.txt so researchers can find that address in one step. A person reads every report and answers within one business day.