Security

All data transmitted between your browser and MuniVEX servers is protected with TLS encryption. Files stored in our cloud infrastructure are encrypted at rest using AES-256 via AWS KMS. Sensitive authentication data, including MFA secrets, is encrypted using AES-256-GCM with dedicated encryption keys.

• TLS encryption for all web traffic
• AES-256 server-side encryption for stored files
• AES-256-GCM encryption for MFA secrets
• Encrypted database connections
• Industry-standard password hashing
• Cryptographic hashing for password reset tokens
• Signed, time-limited download URLs to prevent unauthorized access

MuniVEX enforces strong authentication to ensure only authorized users access the platform.

• Multi-factor authentication (MFA): Time-based MFA with encrypted secrets and single-use backup codes for account recovery.
• Configurable password policies: Minimum length, complexity requirements, and prevention of password reuse.
• First-login password change: New users are required to change their initial password before accessing the platform.
• Account lockout: Automatic lockout after repeated failed login attempts with a cooldown period.
• Session management: Short-lived session tokens with automatic renewal, device tracking, and the ability to view and revoke active sessions.
• Secure password reset: One-time-use, cryptographically hashed reset tokens with automatic expiration.
• Access codes: Cryptographically generated, time-limited access codes for external recipients who don't need full accounts, with rate-limited authentication.

MuniVEX implements a multi-layered access control system to ensure users can only access the data they are authorized to see.

• Role-based access control (RBAC): Five distinct roles (Super Admin, Agency Admin, Agency User, Requester, OPRA Requester), each with precisely scoped permissions.
• Organization isolation: Strict data separation at the database level prevents data leaks between organizations.
• Department-level data isolation: Folders and members are scoped to departments, so users only see data relevant to their work.
• Folder membership: Fine-grained folder access with Owner, Admin, Member, and Viewer roles.
• Compliance gates: Users must accept Terms of Service and change initial passwords before accessing platform resources.

Every action on the platform is recorded in an immutable audit trail. Audit logs capture who did what, when, and from where.

• Login attempts (successful and failed) with IP and device info
• File uploads, downloads, and deletions
• User account changes and permission modifications
• Folder creation, updates, and membership changes
• Access code generation and usage
• Password resets and MFA configuration changes
• Session creation and revocation
• Terms of Service acceptance

Audit logs are stored for long-term retention and can be exported as CSV for compliance reporting.

Every file uploaded to MuniVEX is verified for integrity and scanned for threats before it becomes available for download.

• SHA-256 hashing: A cryptographic hash is computed for every uploaded file and verified on download, ensuring files have not been tampered with.
• Automated virus scanning: All uploaded files are automatically scanned with regularly updated virus definitions. Infected files are quarantined and blocked from download.
• File type validation: MIME type verification ensures uploaded files match their declared type.
• Resumable uploads: Large files can be uploaded reliably, even over unstable connections, with automatic resume support.

MuniVEX employs multiple layers of rate limiting and bot protection to prevent abuse and brute-force attacks.

• Login rate limiting: Limits on login attempts per IP address to prevent brute-force attacks.
• Access code rate limiting: Failed access code attempts are tracked per IP with automatic blocking after repeated failures.
• Password reset rate limiting: Limits on password reset requests to prevent abuse.
• Distributed tracking: Rate limiting is enforced across all application instances for consistent protection.

MuniVEX is hosted on AWS infrastructure within U.S.-based data centers. All data remains in the United States.

• U.S.-only data residency (AWS U.S. regions)
• Encrypted backups with automated recovery testing
• Rate limiting on all API endpoints to prevent abuse
• Industry-standard security headers on all responses
• CORS restrictions to prevent unauthorized cross-origin requests

MuniVEX is built with government security standards in mind. Our security controls are designed to support the requirements of agencies that handle sensitive data.

• Designed for CJIS Security Policy controls: Our platform incorporates controls aligned with Criminal Justice Information Services (CJIS) Security Policy requirements, including encryption, access controls, audit logging, and authentication standards.
• Data sovereignty: All data is stored in U.S. data centers and is not transferred outside the country.
• Records retention: Configurable retention policies to meet your agency's legal requirements, including OPRA compliance.

We take the security of your data seriously. Security is not a feature we bolt on — it is woven into how we design, build, and operate every part of the platform.

We are continuously improving our security posture and are actively working toward formal compliance certifications. If you have specific compliance requirements, we are happy to discuss how MuniVEX can support your needs.

Reporting Security Issues

If you discover a security vulnerability or have concerns about the security of your data, please contact us immediately. We investigate all reported issues and will respond promptly.