How Car56 protects your data

Fire investigation files hold sensitive material: scene photographs, occupant and witness details, and reports that can end up in litigation. Car56 is built to keep that work confidential. Here is exactly how.

Encrypted in transit and at rest

Every connection to Car56 uses HTTPS (TLS), enforced by a strict-transport-security policy so your browser will not fall back to an unencrypted connection. Your cases and files are stored on managed infrastructure that encrypts data at rest.

Your photographs are private

Scene photos are kept in a private storage area that is not publicly reachable. When you reopen a case, Car56 generates a short-lived, signed link to each image that expires within the hour. There is no public URL to your evidence.

ID scans become part of the case file

When you scan the barcode on a driver's license, it is read on your device. The occupant or witness details it fills in — name, address, date of birth, and license number — are part of the investigative record, and they are held under the same protections as the rest of the case: encrypted in transit and at rest, scoped to your account, and removed when you delete the case. If you do not save a person to the case, nothing from that scan is kept.

Only you can see your cases

Access is scoped to the account that created the work. Every request is checked against your identity on the server, and one investigator cannot read another's cases. Government agency accounts are approved automatically; other accounts are reviewed before access is granted.

You can delete your data

You control your cases. Deleting a saved case removes the record and its photographs from storage. When you want something gone, it is gone.

Your reports are treated as work product

Every draft Car56 produces carries a confidentiality notice and is marked as a draft for investigator review until you sign it. Car56 documents what you observed and the determinations you provide; it never reaches an origin, cause, or classification on its own, so the report stays yours to defend.

Hardened by default

Secrets and keys live only on the server, never in your browser. The site sends security headers on every response (HTTPS enforcement, clickjacking protection, content-type protection, and a policy that limits camera, microphone, and location access to Car56 itself).