Executive Summary
This article is not meant to be an exhaustive list of GovWorx security controls, policies and mechanisms. For a more complete view into our security practices we encourage you to review our trust center.
Compliance Frameworks
GovWorx adheres to the following security frameworks including performing annual audits and pentests.
SOC2 Type 2
CJIS
HIPAA
AI Usage
We acknowledge LLMs & AI is a new tool agencies are being intentional about adopting. You can read more about what AI models we use in What AI does GovWorx use?
Security Brief
Network Diagram
GovWorx hosts all data in the US West AWS GovCloud. You can see a network diagram below.
Data Handling
Data Boundary
All data is transmitted in and out of our AWS VPC (Virtual Private Cloud) over a FIPS 140-2 compliant cipher.
Persistence
All representations of customer data are stored in S3 buckets or Amazon RDS. Data is encrypted at rest. Encryption keys are managed by GovWorx and rotated periodically.
Backups
Backups are taken on a nightly basis and replicated across region to us-gov-east-1.
Retention
Customers can choose from a set of retention policies for all uploaded media to be purged. Customers have the option for media with an evaluation on it to be retained indefinitely.
Infrastructure Security & Monitoring
AWS tools are deployed to ensure the infrastructure is safe and secure
AWS Web Application Firewall
System has a WAF installed on it to detect malicious web attacks against the Application Load Balancer (ALB). All traffic flows through the ALB or to the temporary S3 upload bucket
Cloudtrail and Guardduty
All events within the infrastructure are captured in AWS Cloudtrail as a default setting in AWS GovCloud. Guardduty serves as a monitor for these events to detect unusual activity.
Datadog and Datadog SIEM (Security Information & Event Management)
Datadog is used to aggregate logs, metrics and alert us on any possible security events detected in our logs or Guardduty
Application Level Security
User Authentication
User passwords and logins are managed by AWS Cognito. Optionally, customers can choose to use their own Identify Provider and enable SSO. This is available upon request.
Password length is CJIS compliant and managed at the system level for proper length and complexity rules.
We encourage users to bring their own identity provider and use our SAML Integration
MFA
If users are using application as Identity Provider - MFA can be enabled. The only currently supported MFA method is TOTP (Time-Based One Time Password)
Data Retention Policy
Administrators can choose a retention period for all media (BWC videos, Audio Recordings, etc) that come in through an integration.
System Audit Log
Administrators have access to a system wide audit log
Roles and Permissions
The system is role and permission based. Administrators can define roles and assign users to those roles.
