Executive Summary
This article is not meant to be an exhaustive list of GovWorx security controls, policies and mechanisms. For a more complete view into our security practices we encourage you to review our trust center.
Compliance Frameworks
GovWorx adheres to the following security frameworks including performing annual audits and pentests.
SOC2 Type 2
CJIS
HIPAA
AI Usage
To read more specifically about AI, please go to Resources -> GovWorx Responsible & Trustworthy AI Use
What GovWorx Does Not Do With Your Data
Customer audio, transcripts, and CAD data are never sent to OpenAI, Anthropic, Google, or any other external commercial AI provider.
Customer data is never used to train foundation models or to train GovWorx models that serve other agencies.
Customer data is never sold, licensed, or shared with third parties for advertising, analytics, or research.
All AI processing runs inside AWS GovCloud (US) or on Amazon Bedrock within GovWorx's own AWS account boundary. Amazon Bedrock terms prohibit foundation-model training on customer data.
Security Brief
Network Diagram
GovWorx hosts all data in the US West AWS GovCloud. You can see a network diagram below.
Data Handling
Data Boundary
All data is transmitted in and out of our AWS VPC (Virtual Private Cloud) over a FIPS 140-2 compliant cipher.
Persistence
All representations of customer data are stored in S3 buckets or Amazon RDS. Data is encrypted at rest. Encryption keys are managed by GovWorx and rotated periodically.
Backups
Backups are taken on a nightly basis and replicated across region to us-gov-east-1.
Retention
Customers can choose from a set of retention policies for all uploaded media to be purged. Customers have the option for media with an evaluation on it to be retained indefinitely.
Radio Transmissions
Agencies often ask how GovWorx handles radio audio specifically, particularly where community concerns about AI data use have surfaced. The controls described above apply to radio audio, with these specifics:
Ingestion
GovWorx does not tap radio channels or connect to radio infrastructure. Recordings are written by your Voice Logger (e.g., Equature) to a directory your IT team controls. The on-premises GovWorx Data Agent, running on a server you own with read-only credentials you provide, pulls only the files listed in the vendor manifest and transmits them to your tenant over a FIPS 140-2 compliant TLS 1.3 connection. If you stop the Data Agent, ingestion stops.
Storage
Radio audio and transcripts are stored in the AWS GovCloud (US) infrastructure described above, encrypted at rest with AES-256 via AWS KMS. Data does not leave U.S. sovereign cloud boundaries.
Retention
Radio audio follows the same admin-selected retention policy as other ingested media, with automatic S3 lifecycle purge at the end of the window. Admins can also run an on-demand Data Purge from inside CommsCoach.
AI use
Radio audio is never sent to OpenAI, Anthropic, Google, or any external commercial AI provider, never used to train models that serve other agencies, and never sold, licensed, or shared with third parties. All transcription and AI processing runs inside AWS GovCloud (US) or Amazon Bedrock within GovWorx's own AWS account boundary.
Infrastructure Security & Monitoring
AWS tools are deployed to ensure the infrastructure is safe and secure
AWS Web Application Firewall
System has a WAF installed on it to detect malicious web attacks against the Application Load Balancer (ALB). All traffic flows through the ALB or to the temporary S3 upload bucket
Cloudtrail and Guardduty
All events within the infrastructure are captured in AWS Cloudtrail as a default setting in AWS GovCloud. Guardduty serves as a monitor for these events to detect unusual activity.
Datadog and Datadog SIEM (Security Information & Event Management)
Datadog is used to aggregate logs, metrics and alert us on any possible security events detected in our logs or Guardduty
Application Level Security
User Authentication
User passwords and logins are managed by AWS Cognito. Optionally, customers can choose to use their own Identify Provider and enable SSO. This is available upon request.
Password length is CJIS compliant and managed at the system level for proper length and complexity rules.
We encourage users to bring their own identity provider and use our SAML Integration
MFA
If users are using application as Identity Provider - MFA can be enabled. The only currently supported MFA method is TOTP (Time-Based One Time Password)
Data Retention Policy
Administrators can choose a retention period for all media (BWC videos, Audio Recordings, etc) that come in through an integration.
System Audit Log
Administrators have access to a system wide audit log
Roles and Permissions
The system is role and permission based. Administrators can define roles and assign users to those roles.
