Security

No system is perfectly secure. An independent security review is required before real use, and results will be published in summary form.

• Encrypted connections everywhere; sensitive fields and evidence are encrypted before storage.
• Organization and administrator accounts require multi-factor authentication, short sessions, and lockouts after repeated failures.
• Access is limited by role. Administrators cannot read cases; reviews need two different people.
• Notifications never contain sensitive wording. A discreet mode is available.
• Every sensitive action is written to an audit log.

Security researchers: see the contact page for responsible disclosure.