How Car56 protects your data

Fire investigation files hold sensitive material: scene photographs, occupant and witness details, and reports that can end up in litigation. Car56 is built to keep that work confidential. Here is exactly how.

Encrypted in transit and at rest

Every connection to Car56 uses HTTPS (TLS), enforced by a strict-transport-security policy so your browser will not fall back to an unencrypted connection. Your cases and files are stored on managed infrastructure that encrypts data at rest.

Your photographs are private

Scene photos are kept in a private storage area that is not publicly reachable. When you reopen a case, Car56 generates a short-lived, signed link to each image that expires within the hour. There is no public URL to your evidence.

We keep as little as possible from an ID scan

When you scan the barcode on a driver's license, it is read on your device. Only the name and address are added to your report. The license number and the date of birth are never sent to our servers and are never stored. If you do not save a person to the case, nothing from that scan is kept at all.

Only you can see your cases

Access is scoped to the account that created the work. Every request is checked against your identity on the server, and one investigator cannot read another's cases. Government agency accounts are approved automatically; other accounts are reviewed before access is granted.

You can delete your data

You control your cases. Deleting a saved case removes the record and its photographs from storage. When you want something gone, it is gone.

Your reports are treated as work product

Every draft Car56 produces carries a confidentiality notice and is marked as a draft for investigator review until you sign it. Car56 documents what you observed and the determinations you provide; it never reaches an origin, cause, or classification on its own, so the report stays yours to defend.

Hardened by default

Secrets and keys live only on the server, never in your browser. The site sends security headers on every response (HTTPS enforcement, clickjacking protection, content-type protection, and a policy that limits camera, microphone, and location access to Car56 itself).