Security & Data Ownership
CJIS-Compliant AI for Law Enforcement Investigations
Where the data resides, who can reach it, what is recorded, and who owns it: the four questions every technology officer puts to a vendor, answered for DeedEye.
Four Pillars of Security
Access, encryption, audit, and validation. Written for review by technical and compliance staff.
Identity-bound access control on every surface
Every surface sits behind authentication: the web application, service interfaces, and administrative tooling. Authorization is role-based at the account level, with least privilege by default and separation of duties between investigator, supervisor, and administrator roles. Single sign-on (SAML/OIDC) with multi-factor authentication federates to your existing identity provider.
Encryption at rest and in transit, with separated key custody
Case data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Keys are held in a hardware-backed key management service, isolated from the data plane: AWS KMS in the cloud, your equivalent on-premises. Each key carries its own access policy, scheduled rotation, and an independent usage log.
Complete audit trail across sources and actions
Every authenticated request is journaled: identity, timestamp, session, and the objects touched. Evidence carries provenance from the point of ingestion: source attestation, content hash, and trusted timestamp. Every processing step is written to an append-only, tamper-evident log, and your administrators read the audit surface in-product at any time.
Continuous security validation
Security policy is expressed as automated controls, validated on every build and deployment: static analysis, dependency and container scanning, infrastructure-as-code policy checks, and secrets detection gate the pipeline, and a failing control blocks release. Runtime configuration is evaluated continuously against the same baseline. Our control baseline meets CJIS Security Policy requirements and is extended by our SOC 2 implementation pipeline. We welcome peer review and independent audit.
Your Agency Owns Its Data, Always
The agency owns its data: the evidence, the case files, and every artifact DeedEye derives from them. Detelytics operates the software; the agency holds the record.
Portable on demand
Export the full case and its evidence at any time, in open formats.
Excluded from model training
Agency data trains nothing and is never pooled across tenants.
Single-tenant isolation
A dedicated cluster per agency, not a shared database behind a filter.
Destroyed on instruction
On request or at contract end, data is destroyed and the destruction evidenced.
Two Deployment Models
Cloud or on-premises. All four security controls apply in both.
Option A: Cloud (AWS)
- Application plane. Managed Kubernetes (EKS), single-tenant to your agency.
- Case data and evidence. Encrypted object storage and database, inside the same trust boundary.
- Inference (AWS Bedrock). Models invoked inside your boundary, with no consumer AI services.
- Key vault (AWS KMS). Keys isolated from the data plane; every use logged.
- Agency users. SSO with MFA, over TLS 1.2+.
Option B: On-Premises
Agency facility, agency hardware. Choose the platform:
- B1, Cloudera cluster. Licensed from Cloudera, supported by Cloudera, for agencies already standardized on the platform. The platform vendor holds the support contract.
- B2, Detelytics Kubernetes cluster. Delivered under a Detelytics enterprise license: a self-contained stack we license and support directly, with no third-party platform contract.
The Four Questions, Answered Side by Side
| Question | Cloud (AWS) | On-premises (Cloudera or Detelytics) |
|---|---|---|
| Where is DeedEye case data stored? | A single-tenant cluster in the AWS region you designate. Encrypted at rest. | Your facility, your hardware. Encrypted at rest. No data egress from your network. |
| How is DeedEye case data accessed? | Authenticated accounts only, federated via SSO with MFA, authorized by role under least privilege. Transport encrypted end to end. Keys held in a separate vault: AWS KMS in cloud, the agency’s key service on-premises. | |
| What does DeedEye audit? | Every authenticated request: identity, timestamp, session, and objects touched, plus evidence provenance at ingestion and every processing step. Administrators inspect the audit surface directly, in-product. | |
| Who owns and maintains the data? | You own the data. Detelytics maintains the application and cluster under contract. | You own the data and the infrastructure. Platform support from Cloudera (B1) or Detelytics (B2); the application is maintained by Detelytics in both. |
CJIS compliant, with secure tenant hosting on a dedicated cluster per agency. Full architecture documentation, penetration-test summaries, and completed security questionnaires are available under NDA.
Guardrails First
Five invariants enforced in code, a grade on every sentence, and provenance on every finding, so an investigator can always ask where did this come from and get an answer.
| ID | Rule | What it prevents |
|---|---|---|
| INV-1 | Verified anchors | No finding without a re-verifiable citation to source: nothing unattributable reaches a case file. |
| INV-3 | No identity | Structural presence only. Never face recognition, person identification, or a judgment about truthfulness. |
| INV-9 | Open world | “None found” only under proven full coverage: silence is never reported as absence. |
| INV-11 | No naked numbers | No confidence score crosses the display boundary. No false precision driving a decision. |
| INV-13 | Delta scaled | Incremental processing per arrival, not full rebuild, so findings stay current at case scale. |
Citations Annotated by Evidentiary Tier
T1
Established
Multiple independent sources in the file support this. Carries no mark: it is the baseline.
T2
Sourced
One source states it. Attributed, not established.
T3
Analysis
An inference from cited evidence, not a documented fact. Shows its premises and counter-evidence.
T4
Absence
The file does not contain this. A known gap, stated rather than skipped.
Guidance and Enablement We Provide
Role-based operator training
Investigators, supervisors, and administrators are trained on what the system may assert, how to verify an anchor, and how to document a promotion decision.
Supervised onboarding and ingestion
Our team runs your first case end to end with you, including scanning and loading legacy case files.
Written model-use guidance
A policy-ready document covering appropriate use, limitations, and disclosure, drafted to be attached to agency policy or a prosecutor’s discovery packet.
Defined escalation path
A documented route for reporting suspected model error, plus an audit view contrasting AI-proposed against human-promoted findings.
Bring us your policies and we add them to the guardrails. Every AI policy here can be customized for your agency. Send us your security questionnaire and we complete it directly.
Download the Security Brief (PDF)