Privacy

This portal is operated for the agency by a software vendor. Everything you submit — your name, contact details, the description of the records you want, and any files exchanged — is stored on the vendor’s infrastructure and is accessible to the agency.

Account details

Email address and a hashed password. Passwords are never stored in a readable form and cannot be recovered by the agency or the vendor.

Request content

What you asked for, everything sent between you and the agency, and any records released to you.

Server logs

IP address, browser type and pages visited, kept for security monitoring. Not used for advertising and not sold.

Your request activity

When you open your request page and each time you download a record, the time, your IP address and your browser are recorded. The agency staff handling your request can see this, so they can confirm your records reached you. It is not used for anything else.

Public records log

When you view a request on the public records log or download one of its files, the time, your IP address, your browser, the page that linked you there and, if you are signed in, your account are recorded. Agency staff can see this on the request. If your browser sends Do Not Track or Global Privacy Control, the visit is still recorded and marked that way. These entries are kept for the period the agency sets, and like other agency records they may themselves be subject to an open records request.

Payment details

Handled by a third-party payment processor. Card numbers never reach this system and are not stored by the vendor or the agency.

This portal sets only its own cookies.

Session

Keeps you signed in while you use the portal. Expires when you sign out or close your browser.

Security token

Protects form submissions against forgery. Required, and cannot be turned off.

Visitor

Set when you open the public records log, so repeat visits from the same browser are shown together. It holds a random number, nothing about you, is never shared with anyone and lasts one year.

No third-party tracking

There are no advertising or third-party tracking cookies on this portal.

The vendor uses these services to operate the portal. Each receives only what it needs for its function.

Cloud storage and hosting

Files and database records are stored with a commercial cloud provider in the United States.

Email delivery

Notifications and correspondence are sent through an email delivery service.

Payment processing

Fees are collected through a payment processor. The vendor does not receive or store card details.

Transcription

Where the agency has enabled it, audio and video recordings are sent to a speech-to-text service so they can be searched. The remote copy is deleted once the transcript is stored. An agency that has not enabled this sends nothing.

Spam protection

The request and registration forms use Cloudflare Turnstile to check that a submission is not from an automated script. It sets no cookies, does not track you across sites, and does not build a profile of your browsing.

Agency staff

Staff handling your request see everything you submit. That is how the request gets answered.

Vendor staff

A small number of vendor personnel can access the system to keep it running and to resolve faults. Access is limited to that purpose.

The public

Records released to you may be published by the agency, and a request is itself a public record in most jurisdictions. The agency decides what is published; see their policy above.

In transit

All traffic to this portal is encrypted.

At rest

Files and backups are stored encrypted.

Not a guarantee

No system is perfectly secure. Do not send anything through this portal that you would not want disclosed if it were compromised.