Ranger RMS

Security & Compliance

Built for the threat model your agency actually has.

Tyler got ransomwared. HPD lost 264,000 cases. We took the lessons and put them into the architecture, not the marketing copy.

One database per agency.

Multi-tenant SaaS shares a single database between every customer and relies on an application-level customer_id column to keep records apart. One bug, one missingWHEREclause, and another agency's data leaks into yours. We don't do that.

Mission PD
Isolated DB
San Angelo PD
Isolated DB
Lubbock SO
Isolated DB
Each agency runs on its own Neon Postgres project. A breach at one agency cannot structurally affect another.

Posture, not promises.

We list what's shipped and what's still being built. If a control isn't green here, it isn't green in production.

  • Live

    Encryption in transit (TLS 1.2+)

    All traffic between officers, the app, and the database flows over modern TLS. HTTP is rejected at the edge.

  • Live

    Encryption at rest

    Postgres volumes and object storage are encrypted at the disk layer by the platform.

  • Live

    Strong session controls

    JWT sessions with absolute and idle timeouts (30 min idle, 8 hr absolute). httpOnly cookies, SameSite=Lax.

  • Live

    Per-record audit log

    Every state-changing action writes an audit row inside the same transaction. Append-only — deletes are blocked at the database trigger level.

  • Live

    Role-based access control

    Fourteen permission keys, fully customizable roles per agency. Default-role permissions auto-sync on deploy.

  • On deployment

    Multi-factor authentication (TOTP)

    Authenticator-app MFA for all officer accounts. Required by CJIS §5.6 — wires up on your agency's deployment.

  • On deployment

    File upload anti-virus scan

    Inline AV scanning of every uploaded photo, document, and attachment. Activates on deployment.

  • On deployment

    AWS S3 evidence storage

    Per-agency S3 bucket with bucket-scoped IAM, server-side encryption, and CJIS-compliant addendum. Provisioned automatically when your agency goes live.

CJIS §5.4 / 5.5 / 5.6 / 5.10

Per-control checklist tracked internally. 21 ✅ / 9 🟡 / 3 🔴 as of the latest pass — available on request under NDA.

Append-only audit

Every state change is auditable. The audit log itself is protected by a database trigger that rejects deletes.

Your data is yours

Cancel any time and we'll hand you a full export. No lock-in clause, no punitive offboarding fee.