Security and Data Handling

At a glance

• StorageOn Cloudflare, in a database and file store reachable only through PSI Shield
• EncryptionIn transit (HTTPS) and at rest
• SeparationEach agency sees only its own data, enforced on the server
• Sign-inHashed passwords, optional two-factor authentication
• AuditSign-ins, views, exports and admin changes are logged
• Backups30-day point-in-time restore, plus weekly copies kept 8 weeks
• AIRuns only when a user asks; not used to train models
• Not collectedNo audio, no criminal justice information, no advertising or cross-site tracking

Where your data is stored

PSI Shield runs on Cloudflare. Assessment records are kept in a Cloudflare D1 database, and photos, floor plans and uploaded files in Cloudflare R2 storage. Neither is publicly reachable: every request goes through PSI Shield's access checks.

PSI Shield does not currently guarantee that all storage and processing stays inside the United States. If your agency requires U.S.-only data residency, contact us before uploading restricted information.

Encryption

All traffic to and from PSI Shield uses HTTPS. Stored data is encrypted at rest by Cloudflare. Photos and files are never public: each request is checked against the signed-in user's agency before anything is returned.

Who can see your data

• Your agency's users. Each record belongs to one agency, and the server checks the agency on every read, write, photo and file request. Users are invited by the agency's administrator, who can change roles, deactivate users and remove them.
• Co-assessors. Other members of your agency can be added to an assessment. They contribute their own notes and photos, credited to them, and cannot change the lead assessor's record.
• Facility contacts. A facility can be sent a questionnaire by email. The link opens only that questionnaire, expires, and gives no access to the rest of the assessment or the agency's account.
• Facility follow-up portal. After an assessment, the agency can send the facility a private link to that assessment's recommendations. Opening it also takes a 6-digit code emailed to the contact on each visit, so a forwarded link alone shows nothing. The facility sees the recommendations, and the PDF report only if the agency chooses to share it. It never sees the checklist, notes, transcript or the agency's photos. Each update the facility makes is labeled as theirs, and the agency can turn the link off at any time.
• PSI. One PSI super administrator can reach agency accounts for support and security. Each time they open one of your agency's assessments, it is recorded in your activity log.

Sign-in and accounts

• Passwords are never stored. Only a PBKDF2-SHA256 hash (100,000 iterations) is kept.
• Optional two-factor authentication with an authenticator app, with one-time backup codes.
• Repeated failed sign-ins are rate limited by account and by network address.
• Sessions use secure, HttpOnly cookies and expire after 30 days.
• Password reset links expire after 1 hour and work once.

Activity log

PSI Shield records sign-ins and failed sign-ins, assessment views, exports, deletions, invitations, role changes and other administrative actions. Agency administrators can review the log in the admin console. Log entries record who acted and on what; they do not copy assessment content.

Backups and recovery

The database can be restored to any minute in the last 30 days. In addition, a full copy of the database is taken every week and the last 8 weekly copies are kept, in the same private storage as assessment files. Restoring from a weekly copy has been tested.

Photos and files are not edited in place: they are only added or deleted.

Outside services

These providers process data on PSI's behalf to run specific features. None of them receives data for advertising.

Artificial intelligence

AI features run only when a user presses an AI button. The content needed for that request is sent to Anthropic; assessments are never sent automatically. Under Anthropic's commercial terms, this content is not used to train models and is deleted within 30 days, except where Anthropic must keep it for safety enforcement or by law.

AI output is a draft. The assessor reviews it before it goes into a report, and PSI Shield flags drafted text that contradicts the facility's own answers or rests only on aerial imagery.

On your devices

To work offline, PSI Shield keeps a working copy of assessments in the browser until they sync. Signing out removes that copy from the device; if anything has not yet reached the server, the user is asked before it is discarded. Agencies should still apply their usual device security to tablets and laptops used in the field.

Your data, your control

• Your agency owns its assessment data. PSI does not sell it, rent it or use it for advertising.
• Any assessment can be exported at any time as PDF, Word or CSV.
• Deleting an assessment removes its record, photos, floor plan and uploaded files.
• To request a full export of your agency's data, or its deletion, email [email protected].

What PSI Shield does not do

• It does not record audio. Interview transcripts are added as text.
• It is not designed to hold criminal justice information (CJI) and is not CJIS-certified.
• It does not use advertising or cross-site tracking services. Its only analytics is Cloudflare Web Analytics, which uses no cookies.
• It does not currently hold a SOC 2 report.

Security incidents

If PSI confirms that agency data has been accessed, disclosed, changed or lost without authorization, PSI notifies the affected agency without unreasonable delay, with what is known about the incident, the information affected and the steps taken. To report a concern, email [email protected].