Security at Garrizon

Your security data is sensitive. We built Garrizon with enterprise-grade security from day one — not bolted on as an afterthought.

Encryption Everywhere

All data is encrypted in transit via TLS 1.3. Data at rest is encrypted using AES-256 on Cloudflare's global network. Your credentials are hashed with PBKDF2-SHA256 — we never store plaintext passwords.

Multi-Tenant Isolation

Every organization's data is strictly isolated at the database level. All queries are scoped by organization ID. There is no shared data space — one tenant can never access another's records.

Edge-Deployed Infrastructure

Garrizon runs on Cloudflare Workers — a serverless edge network spanning 300+ cities in 100+ countries. No traditional servers to misconfigure, patch, or leave exposed. DDoS protection built-in.

Authentication & Sessions

Session-based authentication with secure, HTTP-only cookies. CSRF protection on all mutating endpoints. Rate limiting on login, signup, and public verification endpoints. OAuth 2.0 support for social login.

Evidence Chain of Custody

All uploaded evidence (photos, videos, documents) is SHA-256 hashed at upload time. Every access is audit-logged with user ID, timestamp, and IP. Tampering is cryptographically detectable.

Access Control & Audit Trails

Role-based access control with four levels: Admin, Supervisor, Manager, and Guard. Every sensitive action is logged. Evidence access generates audit entries. Sessions can be revoked instantly.

Data Residency & Backups

Data is stored on Cloudflare D1 with automatic replication. Backups are performed automatically. Your data never leaves Cloudflare's trusted infrastructure. We do not sell, share, or monetize customer data.

Compliance & Certifications

Automated patrol certificate generation with public verification links — insurers and auditors can verify without creating an account. Guard certification tracking with expiration alerts.

Security Practices

Secure Development

Code is reviewed before deployment. Dependencies are monitored for known vulnerabilities. We follow OWASP guidelines for web application security including protection against injection, XSS, and broken authentication.

Incident Response

We maintain an incident response plan for security events. If a breach is detected, affected customers are notified within 72 hours per GDPR requirements and applicable data protection laws.

Data Deletion

Users can delete their account and all associated data at any time from their profile settings. Personal data is purged within 30 days. See our account deletion page for details.

Responsible Disclosure

If you discover a security vulnerability, please report it to security@garrizon.net. We take all reports seriously and will respond within 48 hours.

Security at a Glance

TLS 1.3

In transit

AES-256

At rest

PBKDF2

Passwords

SHA-256

Evidence

CSRF

Protected

RBAC

4 role levels

300+

Edge locations

72hr

Breach notice

Questions about our security practices?

Contact Security Team