Security

Encryption

Data is encrypted in transit and at rest. All connections to Narrative AI use TLS, and stored case data is encrypted at rest by the underlying managed database and storage layer.

AI data handling

Incident data submitted to generate a report is processed to produce that report and is not used to train AI models. We maintain a zero-retention policy for AI training data.

AI assists officers; it does not replace officer judgment. Every generated report is reviewed and certified by the officer before it is submitted.

CJIS-aligned posture

Narrative AI is built with CJIS Security Policy requirements in mind. Security controls are designed around the practices agencies are accountable to, and our security posture is CJIS-aligned.

Access control and agency data scoping

Access is role-based. Officers, supervisors, and agency administrators each see only what their role permits. Command and administrative functions are restricted to authorized command staff.

Data is scoped to the agency. Each agency’s reports, cases, and command data are isolated to that agency, and access is enforced on the server for every request rather than relying on the interface alone.

Data ownership and exit

The agency owns its data. Reports and case records created in Narrative AI belong to the agency, not to Narrative AI.

Agencies can export their data at any time. Reports export as PDF or plain text and can be copied into any records management system, so an agency retains a usable copy of its records independent of the platform.

On termination, agency data is handled per the terms of your agency agreement. Contact us to arrange an export and to confirm the handling of remaining data.

Security questions

For security questions, vendor-security review, or to request documentation for procurement, contact info@narrative-ai.org. For data residency and data-processing specifics, contact us and we will respond directly.