SECURITY AND DATA PROTECTION
Careful with the data you hold.
Invite-only staff accounts, guardrails on what comes in, a separate permission for personal data and an activity log.
AT A GLANCE
Practical protections, built in.
Choices that limit who can get in and what the platform collects.
Invite-only staff accounts
An administrator adds each person first. There is no self-service sign-up.
Bot checks on forms
A privacy-friendly challenge on forms, applications, donations and checkout.
Separate permission for personal data
Viewing personal data is its own permission, apart from ordinary editing rights.
Activity log
Important actions are written to an activity log.
WHO GETS IN
Access you control.
Staff, applicants and residents each get a sign-in that fits.
- Invite-only staff accountsThere is no self-service sign-up. An administrator must add each person first.
- Sign in with GoogleSign in with a Google account that matches an existing staff user, with protection against forged sign-in requests.
- Secure passwordless staff sign-inStaff sign in with a secure passwordless login, with Google and Microsoft options.
- Two-step verification for publishersRequired for anyone who can publish.
- Separate sensitive-data permissionViewing personal data is its own permission and is not included in ordinary editing rights.
- Private applicant portal linksLinks are stored only as one-way hashes and shown to the applicant once.
- Resident code or link sign-inOne email with a code and a link, locked after five wrong tries.
WHAT COMES IN
Guardrails on public forms and uploads.
- Bot checkA privacy-friendly challenge on forms, applications, donations and checkout.
- Rate limitsLimits slow down floods of public submissions.
- Upload inspectionUploads are checked by their actual contents, and scriptable images and unknown file types are rejected.
- Virus scanning of uploadsUploaded files are scanned for viruses.
- Sensitive-data guardrailsForms, messages and pre-plans refuse Social Security numbers, birth dates, card numbers and secrets such as alarm codes.
GET STARTED FAST. CONTACT US TO LEARN MORE.
See how this works for your department.
Tell us about your department and we will show you the new platform built from your own content.
- Walk through the features that matter to you
- Plan what moves over from your current site
- Agree a practical next step
Request a Website Readiness Review
WHAT WE KEEP
Records, logs and hosting.
- Encrypted secure messagesSecure message bodies are encrypted at rest.
- Preserved records and legal holdSubmitted answers are kept as they were submitted, and a record can be placed on legal hold.
- Activity logImportant actions are written to an activity log.
- Search terms kept out of logsWhat a resident types in the site search is not logged.
- Scrubbed application logsApplication and error logs avoid addresses, subjects and message text. The email log keeps its own record of status, subject and address.
- Provider audits, our own not yet heldResponderMAX.com, Responder MAX CMS and Responder MAX Members all run on infrastructure and service providers that each hold an independent SOC 2 Type II report or ISO 27001 certification, covering hosting, database, file storage, email delivery, DNS, sign-in, error monitoring and video. Responder MAX does not yet hold its own SOC 2 report or ISO certification.
- Backups and recoveryContinuous backups with 14-day point-in-time recovery, plus offsite copies.
- Enforced security policyComing soonA browser security policy that blocks rather than only reports.
VISITOR PRIVACY
Visitors choose. Your site respects it.
- Cookie and privacy choicesA banner or a quiet link labeled Your Privacy Choices, set per department.
- Region-aware consentNotice-and-opt-out for the US and Canada by default, opt-in handling for Quebec and Europe.
- Consent log and reportRecords of visitor choices, with a purge control and an overview report.
- Analytics follow consentAnalytics and ad pixels follow the region’s consent defaults. Global Privacy Control is honoured, and Do Not Track only when enabled.
QUESTIONS
Common questions
Can anyone create a staff account?
No. Accounts are invite-only, and an administrator must add each person first.
Where is the platform hosted?
ResponderMAX.com, Responder MAX CMS and Responder MAX Members all run on infrastructure and service providers that each hold an independent SOC 2 Type II report or ISO 27001 certification, covering hosting, database, file storage, email delivery, DNS, sign-in, error monitoring and video. Responder MAX does not yet hold its own SOC 2 report or ISO certification.
Do analytics run before a visitor agrees?
Configured Google and Meta tags can load before a choice. In opt-out regions they can use the granted mode until the visitor opts out; in opt-in regions they use denied, cookieless mode until consent. Global Privacy Control is honoured, and Do Not Track is honoured only when enabled.
Do forms accept sensitive numbers?
No. Forms, messages and pre-plans refuse Social Security numbers, birth dates, card numbers and secrets such as alarm codes.
Where can I read the full policy?
Our Security & Trust page has the wider picture.
See the whole platform.
Every feature on this page is part of the new Responder MAX CMS for public safety.
Explore the platform