Infrastructure security

Security architecture.

Forevue is built on the assumption that every byte of data it touches is sensitive. The security architecture implements controls aligned with criminal justice information security standards as a best-practice measure.

Security posture

Encryption: AES-256 / TLS 1.2+Audit log: EnabledAccess control: RBAC enforced

Infrastructure

Cloud providerGoogle Cloud Platform (FedRAMP authorized)

ComputeGoogle Cloud Run (serverless, auto-scaling)

DatabaseManaged cloud database (replicated, US data residency)

CDNGoogle Global Edge Network

RegionUS-Central1 (Iowa), configured for US data residency

Encryption

In transitTLS 1.2+ enforced on all endpoints

At restAES-256 encryption for all stored data

PII fieldsApplication-level encryption for SSN, DOB, DL#

Key managementGoogle Cloud KMS with automatic rotation

Questionnaire linksCryptographic token-based, single-use capable

Access control

AuthenticationMulti-factor authentication support

AuthorizationRole-based access (Super Admin, Agency Admin, Investigator)

Agency isolationPlatform security rules enforce cross-agency data segregation

Session managementSecure, httpOnly cookies with automatic expiration

API securityAuthenticated endpoints with rate limiting

Audit and compliance

Audit trailsFull read/write logging on all PII access

CJIS alignmentArchitecture implements controls aligned with CJIS Security Policy as a best-practice measure

Data retentionConfigurable per agency, automatic purge on expiration

Incident responseDocumented incident response plan with 24-hour notification

Penetration testingScheduled third-party security assessments

Responsible disclosure

Report a vulnerability.

If you believe you have discovered a security vulnerability in Forevue, please report findings to hello@forevueinsights.com. Forevue commits to acknowledging reports within 24 hours and providing status updates within 72 hours.

Report a vulnerability