Privacy Policy

1. Introduction

Public Safety Intelligence Technologies LLC ("PSI," "we," "us," or "our") operates PSI Shield, a web-based physical security assessment platform intended for law-enforcement agencies and their authorized personnel.

This Privacy Policy explains what information PSI Shield collects, how it is used, where it is stored, when it may be shared, and the choices available to participating agencies and authorized users.

PSI recognizes that information concerning a facility's physical security, vulnerabilities, floor plans, access controls, and protective measures may be sensitive even when it does not qualify as criminal justice information.

PSI Shield is not designed for the storage or processing of criminal justice information ("CJI") or personal information concerning members of the public that is unrelated to a facility assessment.

2. Our Role and Agency Control

A participating law-enforcement agency is the customer and controls the information its personnel submit to PSI Shield.

The Agency determines which personnel may access its account, which facilities are assessed, what assessment information is entered, and how completed reports are used.

PSI processes Agency information to provide, maintain, secure, and support the Service.

In general, the Agency is responsible for determining whether it has lawful authority to collect, upload, process, and disclose its assessment information.

Requests involving information controlled by an Agency may be referred to that Agency or its designated administrator.

3. Information We Collect

We collect information in the following categories.

A. User and Account Information

• Name.
• Work email address.
• Assigned role and access permissions.
• Department or Agency affiliation.
• Badge number or certification number, when provided.
• Account status and administrative settings.

This information is used to create accounts, identify authorized personnel, manage permissions, and attribute assessment activities and reports to the appropriate users.

B. Authentication and Security Information

• Password verification data stored as a PBKDF2-SHA256 hash, rather than the original password.
• Optional two-factor authentication secrets and backup codes.
• Sign-in and failed sign-in events.
• IP addresses associated with sign-in attempts.
• Account and administrative activity records.

This information is used to authenticate users, identify suspicious activity, enforce access restrictions, and maintain audit records.

C. Facility and Assessment Information

• Facility names and addresses.
• Geographic coordinates, map locations, and property outlines.
• Assessment checklists, ratings, and observations.
• Identified vulnerabilities and security findings.
• Recommendations and corrective actions.
• Agency responses, assigned owners, and target dates.
• Photographs, floor plans, handwritten notes, screenshots, and supporting files.
• Text-based interview transcripts submitted by authorized users.
• Draft and completed assessment reports.

This information is collected when authorized users create, modify, or upload assessment content.

PSI Shield does not provide an audio recording feature. Interview transcripts are processed as text.

D. Facility Questionnaire and Follow-Up Portal Information

Facility contacts may receive an email link allowing them to complete a pre-assessment questionnaire.

Through this process, PSI Shield may collect:

• Questionnaire responses.
• Information voluntarily entered into questionnaire fields.
• Documents and files uploaded by the facility contact.
• Corrections to the property outline shown on the map.

After an assessment, an Agency may also give a facility contact access to a follow-up portal for that assessment's recommendations. The portal requires the link sent to the contact and a 6-digit code emailed to the contact on each visit. Through the portal, PSI Shield may collect:

• The facility contact's name and email address, as provided by the Agency.
• One-time sign-in codes, stored only in hashed form and expiring after 10 minutes.
• Progress updates on recommendations, including status, notes, assigned owners, and target dates.
• The name the facility contact enters to identify who made each update.
• Photographs and documents uploaded as evidence of completed work.
• The date and time of portal sign-ins and updates.

The information becomes part of the relevant Agency's assessment workflow and may be reviewed by its authorized personnel. Updates made through the portal are labeled as reported by the facility. Facility contacts can remove files they uploaded; progress updates are kept as a dated history and can be corrected by submitting a new update.

Facility contacts should submit only information requested for the assessment and should avoid unnecessary personal or restricted information.

E. Activity and Audit Information

PSI Shield automatically records certain activities, including:

• Successful and unsuccessful sign-in attempts.
• Views of assessment information.
• Report and data exports.
• Administrative changes.
• Other supported security and audit events.

IP addresses are collected with sign-in attempts.

These records assist with accountability, incident investigation, security monitoring, and Service administration.

F. Public AI Sample Information

Visitors using the publicly available AI sample may have their IP address recorded along with a daily usage count.

This information is used to enforce usage limits and prevent abuse of the public feature.

The public AI sample is separate from an Agency's authenticated assessment workflow.

4. How We Use Information

PSI uses collected information to:

1. Provide and operate PSI Shield.
2. Authenticate users and control account access.
3. Maintain and organize physical security assessments.
4. Store and retrieve Agency documents and reports.
5. Support collaboration between authorized assessment personnel.
6. Deliver questionnaires, invitations, notifications, and password resets.
7. Generate optional AI-assisted summaries, findings, and drafts.
8. Provide mapping, location, and crime statistics features.
9. Maintain audit logs and investigate suspicious activity.
10. Detect misuse, enforce usage restrictions, and protect Service infrastructure.
11. Respond to customer support requests.
12. Fulfill applicable legal obligations.

PSI does not sell or rent personal information or Agency assessment data.

PSI does not use Agency Data for targeted advertising or unrelated commercial marketing.

5. Artificial Intelligence Processing

PSI Shield offers optional AI-assisted features powered by Anthropic, the provider of Claude AI.

When an authorized user selects an AI function, PSI Shield may transmit the information necessary for the requested operation to Anthropic.

Depending on the feature and user selection, this may include:

• Assessment notes and observations.
• Checklist findings.
• Selected photographs.
• Text-based interview transcripts.
• Information supplied for AI-assisted report drafting.
• Other assessment content selected or submitted for analysis.

PSI Shield does not automatically transmit every Agency assessment to Anthropic merely because the Agency uses the Service.

Anthropic processes submitted information to generate the requested AI output.

Under Anthropic's published commercial API policies, customer inputs and outputs are not used for model training by default unless the customer provides permission through applicable mechanisms. Anthropic's standard API retention policy generally provides for deletion of inputs and outputs within 30 days, subject to exceptions for particular services, contractual arrangements, policy enforcement, and legal requirements.

These are Anthropic's published policies, not a representation that PSI has secured a special zero-retention agreement.

AI-generated results may be inaccurate and must be reviewed by authorized Agency personnel before use.

For more information, visit https://privacy.claude.com.

6. Third-Party Service Providers

PSI Shield uses service providers to operate specific features.

Cloudflare

Purpose: Application hosting, database operations, file and photograph storage, and scheduled processing.

Data involved: Information stored or processed within PSI Shield, including Agency Data, user accounts, documents, and operational records.

Services include Cloudflare D1 database storage and R2 object storage.

Anthropic (Claude AI)

Purpose: Optional AI-assisted drafting, summarization, and analysis.

Data involved: Assessment text, selected photographs, transcripts, and other material submitted through an AI feature.

Resend

Purpose: Transactional email delivery, including invitations, password resets, questionnaires, follow-up portal links and sign-in codes, activity alerts, and reminders.

Data involved: Recipient email addresses and the contents of messages sent through the Service.

United States Census Bureau Geocoding Service

Purpose: Geocoding facility addresses and supporting location-related functions.

Data involved: Submitted addresses and geographic coordinates.

Photon (Komoot)

Purpose: Providing address suggestions as users type.

Data involved: Address text entered into the address search function.

FBI Crime Data Explorer, through api.usa.gov

Purpose: Retrieving geographic crime statistics.

Data involved: State and law-enforcement agency identifiers required for the requested statistical lookup. Assessment documents are not submitted.

Esri (ArcGIS Imagery)

Purpose: Displaying satellite imagery and supporting mapping functions.

Data involved: Map coordinates and associated browser requests needed to retrieve imagery.

Google Fonts

Purpose: Loading website fonts.

Data involved: Browser connection information, including the visitor's IP address, transmitted when requesting font resources.

Cloudflare Web Analytics

Purpose: Counting page views and measuring how quickly pages load, so PSI can see how the website and app perform.

Data involved: The page visited (without the part of the web address after a question mark), the referring page, browser, operating system and device type, approximate country, page-load timing, and technical details about slow-loading page elements (a page-element reference and the address of the image, font or file involved). Cloudflare uses the connection's IP address to determine approximate country; PSI does not receive it. Web Analytics does not use cookies or other browser storage, does not fingerprint visitors, does not track them across other websites, and does not read assessment content.

PSI does not use advertising networks or behavioral tracking services within PSI Shield. Cloudflare Web Analytics, described above, is the only analytics tool in use.

Third-party providers may process technical information necessary to deliver their services under their respective policies and applicable agreements.

7. Data Storage and Location

PSI Shield uses Cloudflare infrastructure to store and process information.

Structured data is maintained using Cloudflare D1, while uploaded photographs, documents, and other files are stored using Cloudflare R2.

PSI Shield does not currently enforce a United States-only data storage restriction or guarantee that all processing occurs exclusively within the United States.

Data location may depend on Cloudflare's infrastructure configuration, service operation, and applicable provider arrangements.

Agencies requiring specific data residency restrictions should contact PSI before submitting restricted information.

8. Security Measures

PSI uses safeguards intended to protect Agency information against unauthorized access, alteration, disclosure, and loss.

These include:

• HTTPS encryption for data transmitted to and from the Service.
• Encryption at rest managed by Cloudflare.
• Password verification using PBKDF2-SHA256 hashing.
• Secure, HttpOnly session cookies.
• A 30-day session lifetime.
• Optional two-factor authentication.
• Rate limiting of failed sign-in attempts.
• Department-level access restrictions enforced by server-side checks.
• Audit logging of administrative and selected user activities.
• Restricted administrative access.
• Database backups: point-in-time recovery for the previous 30 days, plus a full weekly copy of the database retained for 8 weeks, stored in the same private storage as assessment files. Uploaded photographs and files are not included in these backups.
• Facility follow-up portal access that requires both the link sent to the facility contact and a code emailed on each visit, with portal sessions limited to 8 hours.

Agency accounts are logically separated. PSI Shield checks departmental authorization when processing database records and requests for photographs or files.

A designated PSI super administrator may access Agency accounts for authorized operational purposes. Such access is logged.

No security control eliminates every possible risk. Agencies should maintain appropriate internal account management, device security, and records handling procedures.

9. Local Browser and Offline Information

PSI Shield supports offline work by maintaining a working copy of relevant assessment information in the user's browser until synchronization occurs.

This locally stored information may contain sensitive facility details.

Signing out removes this working copy from the device. If any information has not yet synchronized, the user is warned before it is discarded.

Closing the browser without signing out does not remove the working copy; it remains on the device until the user signs out, the information is removed through the application, or browser storage is cleared.

Users should avoid accessing PSI Shield through shared or unsecured devices and should comply with their Agency's device security requirements.

PSI cannot fully control data exported, downloaded, printed, photographed, or otherwise retained outside the Service by authorized Agency users.

10. Cookies and Similar Technologies

PSI Shield uses an authentication session cookie to maintain signed-in sessions.

The cookie is configured with HttpOnly and Secure attributes and has a 30-day lifetime.

The Service also uses browser storage to support application functionality and offline work.

The facility follow-up portal keeps its sign-in only in storage tied to the browser tab, and the portal session expires after 8 hours regardless.

PSI Shield does not use advertising cookies or behavioral tracking technologies. Cloudflare Web Analytics measures page views without cookies or other browser storage and does not fingerprint visitors.

Third-party resources, such as map imagery and hosted fonts, may receive standard browser request information necessary to deliver their content.

11. Information Sharing and Disclosure

PSI may disclose information only as reasonably necessary for the following purposes:

• To provide the Service through the identified technology providers.
• To Agency-authorized users acting within their permissions.
• At the direction of the Agency.
• To investigate security incidents or prevent misuse.
• To comply with legally enforceable requests or applicable law.
• To protect the rights and security of PSI, its customers, and Service users as permitted by law.

PSI does not publish Agency security assessments for public access or disclose them for commercial advertising.

If PSI receives legal process seeking Agency Data, PSI will provide notice to the affected Agency when legally permitted and reasonably practicable.

12. Information Retention

PSI retains Agency Data for the duration of the Agency's active account unless it is deleted through available features or PSI receives an authorized deletion request.

There is currently no general automatic deletion schedule for active Agency assessment data.

Authorized users may delete assessments, and Agency administrators may deactivate or remove user accounts.

Certain operational records, including security and audit records, may be retained to maintain Service integrity and meet applicable legal requirements.

Deleted database records may remain in database backups until those backups expire: up to 30 days for point-in-time recovery and up to 8 weeks for weekly copies. Uploaded photographs and files are not backed up and are removed from storage when the assessment they belong to is deleted.

Following termination of an Agency subscription, PSI will, on request from an Agency administrator, provide an export of the Agency's Data and then delete it from active systems, as described in the Terms of Service.

Information shared with third-party providers may also be subject to those providers' documented retention requirements.

13. Deletion Requests

An Agency administrator may request deletion of Agency Data or account closure by contacting:

[email protected]

PSI will verify the requester's authority before processing account-wide deletion requests.

Deletion requests may be limited or delayed where retention is required by law, preservation obligations, unresolved disputes, or other lawful reasons.

Deleting information from active storage may not immediately remove copies held in authorized exports, local browser storage, backups (which expire within 8 weeks), or third-party systems.

PSI will describe applicable limitations when responding to a deletion request.

14. Individual Privacy Requests

Users wishing to access, correct, or update their account information should first contact their Agency administrator.

Facility contacts with questions concerning submitted questionnaire or follow-up portal information should contact the Agency conducting the assessment.

Privacy-related inquiries may also be submitted directly to PSI.

PSI may refer requests concerning Agency-controlled assessment information to the applicable Agency.

Individual privacy rights will be honored where required by applicable law, taking into account the Agency's authority over its records and any lawful disclosure restrictions.

15. Data Breach and Security Incident Response

PSI investigates reported or detected security incidents involving PSI Shield.

If PSI confirms unauthorized access to or disclosure of Agency Data, PSI will notify the affected Agency without unreasonable delay, consistent with applicable law and contractual obligations. PSI's goal is to notify affected Agencies within 72 hours of confirming such an incident.

PSI will provide information reasonably available concerning the incident and appropriate remediation measures.

Agencies may report suspected security incidents to:

[email protected]

16. Children's Privacy and Information About the Public

PSI Shield is intended for professional and governmental use, not for use by children.

PSI Shield is not designed to collect personal information from children or to maintain criminal investigative information concerning members of the public.

Agencies and authorized users should avoid uploading unnecessary personal information and should follow applicable legal and departmental requirements when documenting facility-related information involving individuals.

17. International Processing

Because the Service relies on third-party infrastructure and does not currently enforce a United States-only data residency restriction, information may be processed or stored outside the Agency's immediate geographic jurisdiction.

An Agency subject to data residency, procurement, or confidentiality restrictions should evaluate these requirements before using the Service.

18. Changes to This Privacy Policy

PSI may revise this Privacy Policy to reflect changes in the Service, its technology providers, operating practices, or applicable legal requirements.

Material changes will be communicated through the Service or by notice to Agency administrators when reasonably appropriate.

The effective date at the beginning of the Policy will identify the current published version.

19. Contact Information

Public Safety Intelligence Technologies LLC

PSI Shield Privacy and Support

Email: [email protected]

Website: https://shield.publicsafetyintel.net

Agencies, authorized users, and facility contacts may submit questions about this Privacy Policy or PSI Shield's information handling practices through the contact address above.