Last updated October 2026
Infrastructure Overview
Application services and stored data are located in the AWS US East (Ohio) region
CrimeGrade does not operate its own servers, password stores, or session databases. Sign-in, authorization, storage, email, and server-side processing all run on AWS managed services, which AWS operates under its SOC 2, ISO 27001, and FedRAMP compliance programs.
| Function | Service | Purpose |
|---|---|---|
| User Authentication | AWS Amazon Cognito User Pools | Registration, sign-in, password management, and two-step verification. Cognito verifies and stores credentials; CrimeGrade never handles them. |
| Authorization | AWS Amazon Cognito Identity Pools + IAM | Exchanges a signed-in session for short-lived AWS credentials limited to the user's own organization. |
| Data Storage | AWS Amazon S3 + Amazon DynamoDB | Locations and reports in per-organization S3 paths; each user's display preferences in DynamoDB, readable only by that user. All encrypted at rest. |
| Server-Side Logic | AWS AWS Lambda | Account setup, branded email, report generation, and user management. Functions that accept outside requests authenticate them first, and there are no long-running servers to patch. |
| Email Delivery | AWS Amazon SES | Verification codes, password resets, and invitations from no-reply@crimegrade.org, signed with DKIM. |
| Content Delivery | AWS Amazon CloudFront | HTTPS-only delivery with TLS 1.2 or higher and security headers on every response. |
| Traffic Filtering | AWS AWS WAF | Screens traffic to the portal and to sign-in: blocks known-malicious sources and common exploit attempts, and limits how quickly any one address can attempt to sign in. |
| Map Data | AWS Amazon CloudFront + AWS Lambda | Delivers the crime map layers, which show the same published statistics as CrimeGrade.org and contain no customer data. |
| Monitoring | AWS Amazon CloudWatch | Alerts the CrimeGrade team to unusual sign-in failures and to unusual sign-up, invitation, or email volume. Keeps an audit log of user-management actions for one year. |
Outside AWS, two features use third-party services: address suggestions while adding a location (Google Maps Platform, which receives the address being typed) and the background street map (OpenFreeMap, which receives requests for the map area on screen). Neither receives account details such as names, email addresses, or organization identifiers.
Authentication & Credential Security
How sign-in is protected
Amazon Cognito manages all user credentials. Passwords travel only from the user's browser to Cognito over an encrypted connection; CrimeGrade's systems never receive or store them.
Password Policy
At least 8 characters, with uppercase, lowercase, numeric, and special characters, enforced by Cognito. Temporary passwords issued with an invitation expire after 7 days.
Two-Step Verification
Users of the reporting portal can turn on two-step verification with an authenticator app such as Microsoft Authenticator or Google Authenticator, and administrators must turn it on before they can manage users. Once it is on, every sign-in also requires a one-time code from that app.
Short-Lived Sessions
Sign-in tokens expire after 60 minutes and are held in the browser tab's session storage, which clears when the tab closes. A user who chooses "Keep Me Signed In" keeps a refresh token on that device for up to 5 days. Signing out revokes the session with Cognito immediately.
Brute-Force Protection
Cognito temporarily locks an account after repeated failed sign-in attempts, AWS WAF limits how quickly any one address can try to sign in, and the CrimeGrade team is alerted to unusual spikes. Sign-in and password-reset responses do not reveal whether an email address has an account.
Organization Data Isolation
How each organization's data is kept separate
Every organization receives a randomly generated identifier when it is created. A server-side process assigns it to each member's account, and neither users nor the portal's browser code can change it.
This identifier governs all data access through a chain of controls enforced by AWS:
| Step | Control | Mechanism |
|---|---|---|
| 1 | Signed token carries the organization | Cognito embeds the organization identifier (custom:organization) in a signed token. Any change to the token invalidates its signature. |
| 2 | Identity pool tags the session | The Cognito identity pool copies the identifier into an IAM session tag (organization) on the user's temporary AWS credentials. |
| 3 | IAM limits access to that organization's path | The S3 access policy uses ${aws:PrincipalTag/organization} to restrict reads to reports/{organization}/*. A user in organization A cannot request organization B's data. |
| 4 | Storage blocks public access | All four S3 Block Public Access settings are on. No customer object can be read anonymously. |
| 5 | Administration stays inside the organization | Inviting users and changing permissions run in a CrimeGrade server function that acts only within the administrator's own organization. Browser credentials carry no user-administration rights. |
The result is isolation that AWS enforces on every request, not code in the browser. A user who modifies the portal's JavaScript still receives credentials that reach only their own organization's data. We verify this with test accounts in separate organizations.
Encryption
Data protection in transit and at rest
In Transit
All connections use HTTPS with TLS 1.2 or higher, including every call to AWS services, and browsers are instructed to use HTTPS only (HSTS). Amazon SES sends email over TLS whenever the receiving mail server supports it.
At Rest
Customer data is encrypted at rest in every service that stores it: Amazon S3 (AES-256), Amazon DynamoDB, and Amazon Cognito, using AWS-managed encryption keys.
Permission Model & Access Control
Least-privilege access within each organization
Each user's permissions are part of their Cognito profile. Only an administrator of the same organization can change them, and only through CrimeGrade's server, which confirms that the administrator and the user belong to the same organization. AWS IAM, not the browser, enforces access to organization data and to user administration.
| Permission | Capability | Default |
|---|---|---|
read | View reports, location data, and map visualizations | All users |
edit | Modify location names, tags, and notes | Granted by an administrator |
generate | Generate new crime risk reports and add locations | Granted by an administrator |
manage | Invite users, adjust permissions, and view all organization members | Organization creator; can be granted by an administrator |
When an organization is created through self-registration, only its founding user receives administrative permissions, and administrators must use two-step verification to manage users. Invited users start with read access until an administrator grants more. Every invitation and permission change is recorded in an audit log.
Email Security
How we handle account email
The portal sends only transactional email (account verification, password resets, and invitations) through Amazon SES from no-reply@crimegrade.org. It sends no marketing email.
DKIM Signing
Every message is signed with a 2048-bit RSA DKIM key, so receiving servers can confirm that it came from CrimeGrade and was not altered in transit.
SPF and DMARC
SPF authorizes Amazon SES to send the portal's mail through a dedicated sending domain, and crimegrade.org publishes a DMARC policy that instructs receiving servers to quarantine mail that fails authentication.
Invitations
Only an organization's administrators can invite users into that organization. Self-registration always creates a new, separate organization and never grants access to an existing one.
Minimal Data in Email
Emails contain only what the recipient needs: a verification code or temporary password and, for invitations, the organization's name and who sent the invitation. Report data and locations are never sent by email.
Application-Level Protections
Protections built into the portal
Content Security Policy
Every page is served with a Content Security Policy that limits the portal to a named list of services, plus headers that block framing by other sites (clickjacking), MIME-type sniffing, and referrer leakage.
Output Encoding
Text that users supply, such as location names, tags, and notes, is HTML-encoded before it is displayed and is never placed inside script code.
Open Redirect Prevention
After sign-in, users are sent only to known portal pages; any other redirect target is ignored.
Cross-Origin Restrictions
Organization data accepts browser requests only from CrimeGrade's own web addresses, in addition to requiring the signed, organization-scoped AWS credentials described above.
What CrimeGrade Does Not Store
Sensitive data kept out of CrimeGrade's systems
The portal is designed so that sensitive material never reaches CrimeGrade's own systems:
| Passwords | Sent only to Amazon Cognito over an encrypted connection. CrimeGrade's systems never receive or store them. |
| Long-lived credentials in the browser | The portal receives only short-lived AWS credentials scoped to the user's organization. No secret keys or service passwords appear in its code; the only key it carries is a website-restricted Google Maps key for address suggestions. |
| Payment card data | The portal does not collect or store payment card numbers. |
| Criminal justice information | CrimeGrade's crime statistics come from published public sources such as the FBI's Uniform Crime Reporting program and the U.S. Census Bureau. The portal holds no Criminal Justice Information (CJI) and no information about victims, suspects, or offenders. |
AWS Compliance Foundations
Programs covering the AWS infrastructure CrimeGrade runs on
CrimeGrade runs on AWS managed services, including Amazon Cognito, S3, DynamoDB, IAM, SES, Lambda, CloudFront, CloudWatch, and AWS WAF, that participate in AWS's independently audited compliance programs, including:
SOC 1 / SOC 2 / SOC 3
Independent audits of AWS's security, availability, and confidentiality controls.
ISO 27001 / 27017 / 27018
Certified information security management, cloud-specific controls, and protection of personal data in the cloud.
FedRAMP
AWS's US East and US West regions hold a FedRAMP Moderate authorization, and AWS GovCloud (US) holds FedRAMP High.
Shared Responsibility
AWS secures the underlying data centers, hardware, and managed services. CrimeGrade is responsible for configuring and operating its application securely, as this page describes.
These programs cover the AWS infrastructure and services CrimeGrade builds on, not CrimeGrade's own application. For the current programs and the services each one covers, see AWS Services in Scope by Compliance Program.
Security Questions & Disclosure
For questions about CrimeGrade's security, or for documentation to support a procurement or security review, contact support@crimegrade.org.
To report a vulnerability, email the same address with the details. Please give us a reasonable time to fix the issue before disclosing it publicly.