Evidence is only as trustworthy as the systems that hold it
We handle evidence that may be used in legal proceedings, so data integrity and access control come first. These are our current practices. We claim no certification we have not obtained.
Current practices
Source data is written once, sealed with hashes and kept in versioned, access-restricted storage.
Production systems accept no inbound connections from the internet. Administrative access passes through an identity-aware proxy.
Keys and credentials never reside in code, and every change is scanned for secrets before it enters version control.
Labels and identity data are backed up daily to restricted, versioned storage, and restores have been tested.
Customer data serves only that customer unless the contract says otherwise.
Report a vulnerability
If you discover a vulnerability, email [security address: to be added once the domain is live]. Please include steps to reproduce it, and withhold public disclosure until we have fixed it.