Security you can put in front of your council.
We take security seriously. Agency information, member data, applicant information, citizen engagement, store and space rentals, and fundraising all need a platform that protects them.
WHY IT MATTERS
What a public safety platform holds, and what stands behind ours.
Whoever builds it, security, ongoing review and knowing who is behind a platform are what to look for. Here is what stands behind ours.
Isolated per agency
Row-level security separates each agency’s data at the database level.
Encrypted in transit and at rest
Connections are encrypted in transit and stored data is encrypted at rest.
Audited infrastructure providers
Our infrastructure and service providers each hold an independent SOC 2 Type II report or ISO 27001 certification. The statement below gives the detail.
Infrastructure audits, and our own.
ResponderMAX.com, Responder MAX CMS and Responder MAX Members all run on infrastructure and service providers that each hold an independent SOC 2 Type II report or ISO 27001 certification, covering hosting, database, file storage, email delivery, DNS, sign-in, error monitoring and video. Responder MAX does not yet hold its own SOC 2 report or ISO certification.
Trusted by fire, EMS, law enforcement and hundreds of public safety agencies across the United States.
Your partner in moving your agency forward.
WEBSITES & THE CMS
Your website, and the CMS behind it.
How editors sign in, what they can reach, and how the system is protected.
Sign-in through Google
Editors sign in with Google, limited to approved company domains. Password login is turned off.
Roles limit what each editor can do
Role-based permissions control who can read, edit and manage users.
Personal data is access-controlled
Form submissions, subscriber and applicant records are readable only by staff with explicit permission.
Private storage for uploads
Uploaded documents are kept in a private bucket that is not publicly readable.
Database access is restricted
Row-level security is on for every table, and the database’s public API is disabled.
Scanned and reviewed on every change
Automated security scanning and code review run on every change, and dependencies are kept current.
RECRUITMENT SUITE & ATS
How applicant data is protected.
MAX Applicant Tracking and Recruit Sites handle personal details, so they carry their own protections.
Isolated per agency
Row-level security separates each agency’s data at the database level.
Encrypted in transit and at rest
Every connection uses HTTPS and all stored data is encrypted. Applicant personal details and messages are also encrypted field by field, with keys managed in AWS KMS.
Only staff you authorize
Access is limited to the team members you choose, with a full audit trail of who viewed, changed or exported a record.
Secure document handling
Uploads are checked for file type and scanned for malware, then kept in private storage that opens only through short-lived links.
No account needed for applicants
Each applicant gets a private link, and a one-time code sent to their email confirms every new device or session. No passwords to create, forget or leak.
We only ask for what you need
No Social Security numbers, no medical history.
MAX MEMBERS
How member data is protected.
Rosters, certifications, service records and, in some cases, personal identifiers. The MAX Members security page has the detail.
Encrypted
TLS in transit, encryption at rest, and AES-256-GCM field-level encryption on the most sensitive data.
Isolated by department
Row-level security scopes every query to your department, enforced by the database, not the app.
Role-based permissions
Role-based permissions, with per-department control over who can see sensitive information.
Secure sign-in
Sign-in through a dedicated identity provider with SSO and multi-factor support.
An accountable trail
Significant actions are recorded for an accountable who-did-what trail.
Audited infrastructure providers
Our infrastructure and service providers each hold an independent SOC 2 Type II report or ISO 27001 certification. The platform runs HTTPS-only with routine backups.
THE SHARED BASELINE
What holds across our platforms.
These appear in the Suite and Members security descriptions alike.
Audited providers
Your data lives with infrastructure and service providers that each hold an independent SOC 2 Type II report or ISO 27001 certification.
HTTPS everywhere
Every connection uses HTTPS.
Scanned on every change
Automated security scanning and dependency updates on every change.
Routine backups
Routine automated backups, with point-in-time recovery for the Recruitment Suite.
Security documentation on request
A security whitepaper and a data processing agreement for your procurement team. If you believe you have found a security issue, tell us right away.
Contact us