How we protect agency data.

Data is encrypted in transit and at rest. All connections to FirstLine platforms use TLS.

Stored agency data is encrypted at rest by the underlying managed database and storage layer.

FirstLine platforms are built with CJIS Security Policy requirements in mind. Security controls are designed around the practices agencies are accountable to, and our security posture is CJIS-aligned.

CJIS-aligned describes our design posture. It is not a certification, and it does not transfer any certification to your agency.

Access is role-based. Officers, supervisors, trainers, and agency administrators each see only what their role permits. Command and administrative functions are restricted to authorized command staff.

Data is scoped to the agency. Each agency’s records are isolated to that agency, and access is enforced on the server for every request rather than relying on the interface alone.

Report drafts in Narrative AI are generated using a third-party large language model (LLM) provider. Content is sent to that provider with retention disabled on every call and is not used to train AI models. The provider’s SOC 2 Type 2 attestation independently confirms API data is not used for training.

AI assists officers; it does not replace officer judgment. Every report is reviewed and certified by the officer before it is submitted.

The agency owns its data. Records created in a FirstLine platform belong to the agency, not to FirstLine.

Agencies can export their data at any time. Records export in portable formats and can be retained independently of the platform.

On termination, agency data is handled per the terms of your agency agreement. Contact us to arrange an export and to confirm the handling of remaining data.