Security

All data transmitted between your browser and MuniVEX servers is protected with TLS encryption. Files stored in our cloud infrastructure are encrypted at rest using AES-256 via AWS KMS. Sensitive authentication data, including MFA secrets, is encrypted using AES-256-GCM with dedicated encryption keys.

• TLS encryption for all web traffic
• AES-256 server-side encryption for stored files (encryption happens on our servers after upload; files are not encrypted inside your browser)
• AES-256-GCM encryption for MFA secrets
• Encrypted database connections
• Industry-standard password hashing
• Cryptographic hashing for password reset tokens
• Signed, time-limited download URLs to prevent unauthorized access

MuniVEX enforces strong authentication to ensure only authorized users access the platform.

• Multi-factor authentication (MFA): Time-based MFA with encrypted secrets and single-use backup codes for account recovery.
• Configurable password policies: Minimum length, complexity requirements, and prevention of password reuse.
• First-login password change: New users are required to change their initial password before accessing the platform.
• Account lockout: Automatic lockout after repeated failed login attempts with a cooldown period.
• Session management: Short-lived session tokens with automatic renewal, device tracking, and the ability to view and revoke active sessions.
• Secure password reset: One-time-use, cryptographically hashed reset tokens with automatic expiration.
• Access codes: Cryptographically generated (256-bit), time-limited access codes for external recipients who don't need full accounts. Codes are stored hashed, can be revoked, can be limited to a single download, and can require an emailed PIN. Authentication is rate-limited.

MuniVEX implements a multi-layered access control system to ensure users can only access the data they are authorized to see.

• Role-based access control (RBAC): Five distinct roles (Super Admin, Agency Admin, Agency User, Requester, OPRA Requester), each with precisely scoped permissions.
• Organization isolation: Every request is checked against the signed-in user's organization, so one agency cannot list or open another agency's folders or files.
• Department-level data isolation: Folders and members are scoped to departments, so users only see data relevant to their work.
• Folder membership: Fine-grained folder access with Owner, Admin, Member, and Viewer roles.
• Compliance gates: Users must accept Terms of Service and change initial passwords before accessing platform resources.

Security-relevant actions on the platform are recorded in an append-only audit log that captures who did what, when, and from where. The database rejects any update or deletion of an audit entry — including by our own administrators — which is what we mean by "immutable."

• Login attempts (successful and failed) with IP and device info
• File uploads, previews, downloads, and deletions
• User account changes and permission modifications
• Folder creation, updates, and membership changes
• Access code generation and usage
• Password resets and MFA configuration changes
• Session creation and revocation
• Terms of Service acceptance

Audit logs are stored for long-term retention and can be exported as CSV for compliance reporting.

Every file uploaded to MuniVEX is hashed and scanned for malware before it can be downloaded.

• SHA-256 hashing: A cryptographic hash is computed for every uploaded file and shown alongside it, so a recipient can confirm the file they received is the file that was uploaded.
• Malware scanning before download: Every upload is scanned by an antivirus engine with regularly updated definitions, and a file can be downloaded only once its scan result is clean. Files flagged as infected, files whose scan did not complete, and files too large to scan are blocked from download until an agency administrator reviews them. No scanner catches every threat; your agency should still follow its own handling policies.
• Resumable uploads: Large files can be uploaded reliably, even over unstable connections, with automatic resume support.

MuniVEX employs multiple layers of rate limiting and bot protection to prevent abuse and brute-force attacks.

• Login rate limiting: Limits on login attempts to prevent brute-force attacks.
• Access code rate limiting: Failed access code attempts are tracked, with automatic blocking after repeated failures.
• Password reset rate limiting: Limits on password reset requests to prevent abuse.
• Consistent enforcement: Rate limits are enforced platform-wide, not per server.

MuniVEX is hosted on AWS infrastructure in U.S. commercial regions. All data, including backups, stays in the United States. Nothing is installed on your agency's network.

• U.S.-only data residency (AWS U.S. regions)
• Encrypted automated database backups, retained for 14 days
• Rate limiting on authentication endpoints to prevent abuse
• Industry-standard security headers on all responses
• CORS restrictions to prevent unauthorized cross-origin requests

MuniVEX is built with government security standards in mind. Our security controls are designed to support the requirements of agencies that handle sensitive data.

• Designed for CJIS Security Policy controls: Our platform incorporates controls aligned with Criminal Justice Information Services (CJIS) Security Policy requirements, including encryption, access controls, audit logging, and authentication standards.
• Data sovereignty: All data is stored in U.S. data centers and is not transferred outside the country.
• File expiration: Configurable expiration and download windows so files are removed on the schedule your agency chooses. Your agency decides what its records laws (including OPRA) require.

Security on MuniVEX is shared between Sasor and your agency.

Sasor is responsible for the controls described on this page: the hosted platform, encryption in transit and at rest, authentication and access controls, malware scanning, the append-only audit log, backups of our systems, and notifying your agency of security incidents that affect your data.

Your agency is responsible for deciding whether its use of MuniVEX is permitted under the CJIS Security Policy, its state CJIS agreements, court and discovery rules, records-retention law, and its own policies; for every file it uploads and whom it shares it with; for verifying the identity of requesters before issuing access; for protecting access codes and links once issued; for choosing expiration and retention settings; for its users and their credentials; and for keeping its own authoritative copy of every file. MuniVEX is a delivery mechanism, not a system of record.

The full allocation is in our Terms of Service.

We would rather you hear this from us than find it out later:

• No certifications. MuniVEX is not certified, accredited, or audited under the CJIS Security Policy, FedRAMP, SOC 2, HIPAA, or any other framework. "Designed with CJIS controls in mind" means we built controls that map to the policy; it does not mean anyone has audited us against it.
• Not GovCloud. MuniVEX runs in AWS commercial U.S. regions, not AWS GovCloud. Our load balancer uses a FIPS-approved TLS policy and we use FIPS endpoints for AWS services, but the application itself does not run on a FIPS-validated cryptographic module.
• No on-premises option. There is no hybrid or on-premises agent. All files are stored in our hosted environment.
• No client-side encryption. Files are protected by TLS in transit and encrypted on our servers at rest. They are not encrypted inside your browser before upload, and Sasor holds the keys needed to operate the Service.
• No restore-test program. Database backups are automated and encrypted, but we do not currently run scheduled restore drills. Keep your own copy of every file.
• No uptime commitment during beta. The Service is a free beta provided as-is. See the Terms of Service.
• Free beta. There is no certification roadmap with a committed date. We intend to pursue a formal audit (such as SOC 2) when customer demand warrants it, and we will update this page when that happens.

We take the security of your data seriously. Security is not a feature we bolt on — it is woven into how we design, build, and operate every part of the platform.

We are continuously improving our security posture. We do not hold any formal certification today (see above). If your agency has specific compliance requirements, we are happy to walk through our controls with you so your agency can make its own determination.

Reporting Security Issues

If you discover a security vulnerability or have concerns about the security of your data, please contact us immediately. We investigate all reported issues and will respond promptly.