Security

Alarm and gate codes

• Encrypted, with a key for each company. Alarm codes, gate codes and site notes are encrypted with AES-256-GCM. Each company has its own encryption key, which is itself encrypted with a master key. Each encrypted code is tied to its company, site and field, so it can't be decrypted if it is copied anywhere else.
• Password re-entry. Seeing or changing a code requires the person to have entered their password within the last two minutes, so a phone left unlocked in a patrol car doesn't give away a client's codes.
• Only the people who need them. Codes are shown only to the roles that need them in the field.
• Changes are approved and logged. An officer can propose a new code, which a supervisor or administrator approves or rejects; the proposed code is kept encrypted and is deleted once the proposal is decided. Every change records who made it, when and how. The codes themselves never appear in logs.
• Destroyed on closure. When a company closes its account, its codes are destroyed immediately and cannot be recovered.

Separation between companies

Many patrol companies use Master Patrol, and none can see another's data. Every request is tied to the company named in the person's signed sign-in token, and every database query is limited to that company. Automated tests try to reach one company's data while signed in as another, and must be refused.

Access inside your company

• Roles. Administrators, office staff, supervisors, officers, probationary officers and dispatchers each get what their job needs. The role is checked on every request, not just hidden in the menus.
• Approvals. Officers can't change a site record directly; they propose changes for a supervisor or administrator to approve.
• Sensitive fields. Custom site fields you mark as sensitive need password re-entry before they are shown.
• Clients see only their own sites. A client contact sees only the sites they are linked to with portal access. Internal details, such as entry routes, key numbers and lockbox information, are never shown to clients.
• Account status is enforced on every request. If an account is locked or closed, the server refuses access even to people who are still signed in.
• Idle sign-out. Your administrator chooses how long a screen can sit idle before Master Patrol signs it out.

Photos and files

• Uploads are limited to photo, document and video types, size-limited, and checked to make sure the file really is the type it claims to be.
• Location data embedded in photos is removed on upload. The position a report was made from is recorded separately, as part of the report.
• Files are only ever served through Master Patrol's own permission checks.

Connections and payments

• Every connection uses HTTPS, and browsers are told never to connect without it.
• For security, Master Patrol accepts connections only from the United States.
• Payments are handled by Stripe. Card and bank details go straight to Stripe; Master Patrol never sees or stores full card or account numbers.

Your data stays yours

The patrol company controls its data and decides what happens to it; Master Patrol processes it only to provide the service. We do not sell it or use it for advertising. The Privacy Policy and Data Processing Addendum describe retention, deletion and what happens when an account is closed.

Reporting a security problem

If you believe you have found a security problem in Master Patrol, email support@master-patrol.com with the subject “Security report”. Please give us a reasonable chance to fix it before telling anyone else, and don't access other people's data while investigating. Never send passwords or alarm codes by email.