Snapshot 232139
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Peregrine Trust Center Peregrine empowers the people who protect our communities by transforming fragmented public-safety data into clear, actionable intelligence. Built for the real challenges faced by law enforcement, emergency response, and justice agencies, our platform unifies information from systems that have never meaningfully worked together—unlocking insights that save time, strengthen decisions, and ultimately help keep people safe. We believe those who serve the public deserve technology that is fast, trustworthy, and intuitive, and we’re committed to delivering tools that honor their mission, elevate their impact, and build safer, more resilient communities. Powered by Wolfia. Review compliance certifications, security policies, subprocessors, and request access to detailed documentation. Skip to main content Peregrine Trust Center Peregrine empowers the people who protect our communities by transforming fragmented public-safety data into clear, actionable intelligence. Built for the real challenges faced by law enforcement, emergency response, and justice agencies, our platform unifies information from systems that have never meaningfully worked together—unlocking insights that save time, strengthen decisions, and ultimately help keep people safe. We believe those who serve the public deserve technology that is fast, trustworthy, and intuitive, and we’re committed to delivering tools that honor their mission, elevate their impact, and build safer, more resilient communities. compliance@peregrine.io ⌘K OverviewSecurityControlsUpdatesFAQ Security Standards Industry and Regulatory Trust center by Wolfia: AI trust center & security questionnaire automation Want a trust center like this one? Get one for your company with Wolfia Controls Access control Robust identity and permission safeguards prevent unauthorized system access and enforce least-privilege principles Single sign-on integration Role-based least privilege Single sign-on support Principle of least privilege Quarterly access reviews Automated SCIM provisioning Role-based access control Automated user provisioning Formal onboarding and off-boarding Encrypted administrative access Annual access reviews Segregated administrator accounts Rapid de-provisioning Encrypted production access Multi-factor authentication Data security Encryption, retention and classification controls protect customer information throughout its lifecycle Encryption at rest Encryption in transit Data retention and deletion policy Full-disk workstation encryption Data classification policy Data classification program Data classification scheme Secure retention and disposal Full-disk encryption on endpoints Secure data disposal Customer data deletion on request Full-disk device encryption Automated, replicated backups No training on customer data Application security A mature secure development lifecycle and continuous testing keep the platform resilient against software threats Secure development policy Annual third-party penetration testing Secure development lifecycle Static and dynamic code analysis Dependency vulnerability scanning Mandatory peer code reviews Automated dependency scanning Penetration testing program Annual penetration testing Web application firewall Mandatory code reviews Secrets exposure remediation SLA Trusted container images Container image hardening Trusted container registry Deployment approval workflow Updates Trust center by Wolfia: AI trust center & security questionnaire automation Want a trust center like this one? Get one for your company with Wolfia Controls Access control Robust identity and permission safeguards prevent unauthorized system access and enforce least-privilege principles Single sign-on integration Support for SAML 2.0 and OpenID Connect lets customers apply their own identity policies while providing users with seamless access. Role-based least privilege Access rights are provisioned strictly to the minimum level necessary for each role, cutting down lateral movement and data exposure. Single sign-on support Customers can enforce their own identity policies through SAML 2.0 and OpenID Connect, allowing corporate MFA, conditional access, and streamlined user lifecycle management. Principle of least privilege User roles are provisioned so each person only receives the minimum access needed for their job, limiting the blast radius of any compromised credential. Quarterly access reviews Leadership reviews and validates every privileged account every quarter to ensure permissions remain appropriate as roles change. Automated SCIM provisioning User accounts are automatically created, updated, and removed based on identity-provider changes, preventing orphaned access and ensuring timely deprovisioning. Role-based access control Granular admin, expert, and user roles map directly to business needs so permissions align with least-privilege principles. Automated user provisioning SCIM 2.0 and just-in-time provisioning automatically create, update or revoke accounts when staff join, move or leave, eliminating orphaned access. Formal onboarding and off-boarding New users receive documented approval before accounts are created and departing users have all access disabled within one business day, eliminating orphaned credentials. Encrypted administrative access Production environments may only be reached through approved encrypted channels, safeguarding credentials and session data in transit. Annual access reviews Documented reviews of all production accounts verify that privileges remain appropriate and any unnecessary access is removed. Segregated administrator accounts Personnel with elevated privileges use separate admin credentials, keeping routine activities isolated from powerful functions. Rapid de-provisioning Accounts for departing personnel are disabled within one business day, closing common insider threat windows. Encrypted production access Only authorized personnel can reach production resources and must do so through approved, encrypted channels to shield credentials and traffic from interception. Multi-factor authentication All privileged and customer-facing systems require a second factor to verify user identity, dramatically reducing the likelihood of account takeover attacks. Data security Encryption, retention and classification controls protect customer information throughout its lifecycle Encryption at rest Customer data, temporary files and backups are protected with strong AES-256 encryption whenever stored on disk. Encryption in transit Secure transport protocols are mandated for all external and internal transfers, preventing eavesdropping over public networks. Data retention and deletion policy Customer data is purged within 90 days of contract termination, with optional zero-retention modes for stricter needs. Full-disk workstation encryption Company-issued laptops are required to use whole-disk encryption, preventing data loss if a device is lost or stolen. Data classification policy Information is tagged as secret, confidential, internal or public to dictate handling, retention and disposal requirements in line with legal obligations. Data classification program Information is labeled public, internal, customer or company data to ensure each class receives the right protection level. Data classification scheme Information is labeled as secret, confidential, internal, or public, enabling appropriate handling, retention, and disposal according to sensitivity. Secure retention and disposal Data is retained only for the customer-defined period and purged within 90 days of contract end or sooner on request, meeting regulatory and contractual mandates. Full-disk encryption on endpoints Employee laptops are required to use full-disk encryption, reducing data-exposure risk if a device is lost or stolen. Secure data disposal Electronic media containing confidential information is purged or destroyed and certificates of destruction are retained. Customer data deletion on request Processes allow customers to have their data securely erased or expired data removed in line with contractual and regulatory obligations. Full-disk device encryption All employee laptops are centrally enforced to use disk-level encryption, locking out attackers even if hardware is lost or stolen. Automated, replicated backups Daily backups are run automatically and replicated across availability zones, providing encrypted copies for disaster recovery. No training on customer data Customer documents and queries are never fed into shared AI models, eliminating unauthorized reuse and safeguarding proprietary information. Application security A mature secure development lifecycle and continuous testing keep the platform resilient against software threats Secure development policy Documented standards embed security requirements throughout design, coding, testing, and deployment activities. Annual third-party penetration testing Independent security experts test the production environment each year, and all high or critical findings must be remediated before closure (current retest shows zero). Secure development lifecycle Documented policies integrate security requirements and reviews into every phase of software design, build, test and release. Static and dynamic code analysis Automated scanning of source and running applications detects weaknesses early in the build pipeline. Dependency vulnerability scanning GitHub Dependabot scans every build for known CVEs, automatically opening pull requests so patches are applied before vulnerabilities can be exploited. Mandatory peer code reviews Experienced engineers must approve every code change, ensuring adherence to secure coding practices before release. Automated dependency scanning GitHub Dependabot continuously flags vulnerable libraries so engineering can patch or replace them quickly. Penetration testing program Independent testers conduct at least annual assessments, with the latest report showing zero critical findings after remediation. Annual penetration testing Independent testers probe the production environment each year, and high-severity findings are tracked to verified closure. Web application firewall A managed WAF blocks common web threats and combined DDoS protection keeps the service available even during volumetric attacks. Mandatory code reviews Every change requires approval by qualified reviewers to catch defects and enforce secure coding standards before deployment. Secrets exposure remediation SLA Discovered hard-coded or exposed secrets follow strict timelines—critical items fixed within 10 days—to eliminate attack windows. Trusted container images All application containers are built from approved sources and stored in a private registry to block malicious code insertion. Container image hardening Only trusted, privately stored container images can be deployed, reducing the chance of introducing malicious or unverified code to production. Trusted container registry Production images are pulled only from a private registry populated with vetted sources, preventing unverified code from entering the platform. Deployment approval workflow Branch protections and enforced reviews mean only qualified engineers can promote code, preventing unauthorized or risky changes from reaching customers. Infrastructure security Layered cloud defenses harden the hosting environment against network and platform attacks Intrusion detection with GuardDuty AWS GuardDuty continuously analyzes logs for malicious activity and alerts security responders. Multi-zone cloud hosting Production workloads run across separate availability zones, eliminating single points of failure and improving uptime. Multi-zone hosting architecture Workloads run across multiple availability zones, removing any single point of failure and improving service uptime commitments. Multi-zone redundancy Services run across multiple cloud availability zones so a single-site failure does not impact customer uptime. Web application firewall Perimeter filtering blocks common exploits and DDoS traffic before it can impact application availability or data. Network segmentation and firewalls Layered firewall rules and segmented VPCs restrict east-west traffic and block unauthorized external connections. Load balancing Traffic is automatically distributed across instances and zones, adding capacity and mitigating localized spikes or failures. Private VPC network segmentation Production resources reside in isolated subnets so internal services are not directly exposed to the internet. Baseline configuration enforcement Systems are continuously monitored for drift from approved configurations and automatically remediated or alerted. Automated backups with geographic redundancy Encrypted backups run daily and replicate to separate zones so data can be rapidly restored even in a regional outage. Firewall with default-deny rules Network firewalls block all traffic unless explicitly allowed, reducing exposure to unsolicited connections. Multi-zone deployment Running the platform across multiple availability zones increases resilience against data-center failures. Automated scaling and load balancing The platform automatically provisions resources and distributes traffic as usage grows, maintaining performance without manual intervention. Cloud threat detection Continuous monitoring services watch for anomalous activity in accounts and generate real-time alerts for security personnel. Managed DDoS and WAF protection Cloud-native web application firewall and DDoS services filter malicious traffic before it reaches application resources. Firewall rules management Ingress and egress rules tightly control network traffic to only required ports and protocols. Network firewalls with default-deny Ingress and egress rules block all traffic unless explicitly permitted, reducing the platform’s attack surface. Auto-scaling and capacity monitoring Real-time metrics trigger automated provisioning of additional resources to maintain performance under load. Incident response Documented processes and regular drills ensure swift detection, containment and communication of security events Incident response plan Clear playbooks define roles, escalation paths and customer notification procedures for security events. Documented incident response plan Comprehensive playbooks define roles, escalation paths, and evidence preservation steps so teams can act decisively under pressure. Formal incident response plan Clear roles, escalation paths and communication protocols are in place so the team can act decisively during a security event. Annual incident simulations Table-top and drill exercises test the plan each year, driving improvements from real-world lessons. Real-time security alerting Monitoring tools send immediate notifications to dedicated channels, ensuring swift human review of potential incidents. Real-time alerting channels Security tools stream alerts to dedicated channels monitored by the response team, reducing mean-time-to-detect and respond. Real-time alerting to response team Monitoring tools push security alerts to dedicated channels, enabling immediate triage by on-call personnel. Ticket-based incident tracking All incidents are logged and tracked to closure, providing auditable evidence of timely remediation. Evidence preservation procedures All incident workflows include collecting and safeguarding logs and artifacts to support forensic analysis and reporting. Annual incident response drills Table-top and technical exercises validate that procedures work as intended and highlight areas for continuous improvement. Root-cause analysis reviews Post-incident reviews identify systemic issues and feed improvements back into the security program. Post-incident reviews After any incident, the team conducts root-cause analysis and documents lessons learned to prevent recurrence. Dedicated incident response team Trained personnel are on call to triage, contain, and communicate security incidents, ensuring rapid, coordinated action. Tracked remediation follow-ups Tasks arising from an incident are prioritized, assigned and monitored to completion to verify issues are fully resolved. Compliance and auditing Independent attestations, internal reviews and insurance demonstrate commitment to recognized frameworks SOC 2 type II certification An external auditor validated the design and operating effectiveness of controls over security, availability, and confidentiality for a three-month period. SOC 2 Type II report A licensed CPA firm verified that controls for security, availability, and confidentiality were designed and operated effectively throughout the audit period. SOC 2 Type II certification An external audit confirmed the design and operating effectiveness of controls for security, availability and confidentiality over a full period. Annual control self-assessments Management reviews each security control yearly to verify effectiveness and document remediation actions. External penetration test attestation A formal report from a certified security firm confirms that all previously identified findings were remediated and no new vulnerabilities remain. External auditor attestation Independent CPAs examined the system using AICPA standards and issued an unqualified opinion on control effectiveness. Compliance management platform A centralized tool continuously gathers evidence and monitors control status, streamlining audits and reducing manual effort. Annual policy review and approval Senior management formally re-evaluates and signs off on the information security program every year to keep it current. Continuous control monitoring Automated checks alert owners when a control drifts out of compliance, enabling prompt corrective action. Annual risk assessment The organization formally documents and rates risks each year, using results to prioritize new or improved controls. Bug bounty program Ethical hackers are incentivized to disclose vulnerabilities responsibly, providing an extra layer of continuous security testing. Cyber liability insurance A $1 million liability policy provides financial backing and assurance to customers in the unlikely event of a breach. Policy review cadence Information security policies are formally reviewed and approved at least once per year. Quarterly executive security reviews Senior leadership reviews security objectives and metrics every quarter, ensuring governance and accountability remain aligned with business goals. Monitoring and logging Comprehensive, immutable telemetry enables rapid threat detection and forensic analysis Centralized log management Logs from applications and infrastructure flow to an immutable store where they are retained per policy for audits. Central log aggregation System, application, and access logs flow into a unified platform that supports searching, correlation, and retention. Centralized log aggregation System and application logs are collected in one place where automated rules detect suspicious patterns. Continuous security monitoring Automated tools analyze logs and metrics for anomalies, sending high-fidelity alerts to security staff. Automated threat detection Machine-learning analysis continuously looks for unusual behavior in cloud accounts and triggers alerts for review. Threat detection with GuardDuty Machine-learning analytics monitor cloud accounts for anomalies and alert security staff within minutes. Infrastructure performance alerting Grafana and related tooling trigger alerts when predefined thresholds are exceeded, supporting availability SLAs. Immutable access logs Privileged activity records are protected from alteration, ensuring reliable audit trails for investigations. Immutable audit trails Administrative users cannot modify or delete their own activity logs, ensuring trustworthy evidence for investigations or audits. Continuous vulnerability scanning Amazon Inspector routinely assesses workloads for known CVEs, assigning risk scores that drive remediation. Host and network IDS Combined sensors detect anomalous activity at both host and network layers for comprehensive coverage. Capacity and performance monitoring Real-time dashboards track usage metrics and latency, helping teams act before performance issues arise. Threat intelligence integration Detection rules leverage industry feeds to spot known malicious IPs or behaviors before they impact customers. Public status and metrics page Customers can view real-time uptime, latency and historical incident data for full operational transparency. Access log reviews Privileged and data-access logs are periodically reviewed by security to confirm activity remains legitimate. Third-party management Structured vetting and ongoing oversight reduce supply-chain and subprocessor risks Vendor due-diligence assessments Cost, functionality, security, privacy and financial health are evaluated before onboarding any critical provider. Vendor inventory and risk rating All service providers are cataloged and scored based on access level and criticality, guiding review depth. Vendor inventory and risk ranking All subprocessors are cataloged and scored based on data sensitivity and service criticality, guiding review depth and frequency. Vendor inventory and risk categorization All third parties are cataloged and scored based on access level and criticality to prioritize due diligence. Annual vendor reviews Critical vendors and subprocessors undergo yearly reassessment to confirm they still meet contractual and security requirements. Annual security due diligence Key vendors provide independent audit reports or equivalent evidence that their controls meet company requirements. Security due-diligence reviews Contracts and SOC reports are annually examined to verify that vendor controls align with company security and privacy requirements. Security and privacy due diligence Terms of service, privacy policies and attestations are reviewed before onboarding and during annual reassessments. Mandatory non-disclosure agreements NDAs are executed with all third parties before any confidential information is shared. Contractual confidentiality obligations Agreements mandate that vendors uphold security, confidentiality, and privacy commitments consistent with customer expectations. Zero data retention commitments Core AI and infrastructure providers contractually agree not to store or retain customer inputs or outputs, preventing uncontrolled data propagation. SOC report reviews for cloud host Management examines AWS SOC 2 attestations each year to validate complementary controls remain effective. Zero data retention clauses for AI providers Contracts with foundational model vendors forbid storing or reviewing customer data, eliminating secondary exposure. Subservice organization monitoring Cloud hosting and other critical providers are continuously evaluated against a shared-responsibility model to confirm alignment. Subprocessor transparency list An up-to-date list of authorized subprocessors is available to customers, supporting informed risk decisions and compliance obligations. Subservice oversight procedures Documented monitoring ensures complementary controls at subservice providers support Wolfia’s own commitments. Public subprocessor list Customers receive transparency into all subprocessors so they can evaluate downstream risks. Confidentiality clauses in contracts Vendor agreements include binding confidentiality and privacy obligations aligned with customer requirements. Privacy and data governance Policies and processes uphold stringent privacy standards and empower customer control over information High-standard data handling All customer information is managed at the highest protection tier, avoiding lower-class segregation. Confidentiality commitments in contracts Customer agreements and the public trust center clearly state the company’s obligations for protecting private information. Privacy policy and DPA Comprehensive documents define roles, responsibilities, and safeguards for personal data processing in line with global regulations. Customer-directed data deletion Data is promptly erased upon customer request and automatically purged when contractual retention limits expire. Data subject access procedure Verified requests are fulfilled promptly, giving individuals control over their information and demonstrating regulatory compliance. Data retention and disposal policy Information is kept only as long as necessary, with secure deletion processes triggered by schedule or customer request. Secure data disposal procedures Formal guidelines ensure information is destroyed safely once it is no longer required. No AI training on customer data Customer content is never used to improve generalized models unless a bespoke contract explicitly authorizes it. Default confidential data handling All data is treated as confidential unless explicitly classified otherwise, ensuring conservative safeguards by default. Highest protection tier by default All customer data is handled as highly sensitive, eliminating the risk of lower-tier protections and simplifying compliance reviews. Data isolation for confidential stores Sensitive datasets are segregated into dedicated storage locations to enforce tailored access and retention rules. Customizable retention options Clients may choose default, shortened or ephemeral retention modes to align with their compliance requirements. Regional data residency options Customers may request alternate storage locations, supporting jurisdictional requirements without compromising security controls. Transparent trust center disclosures Security objectives, commitments and documentation are published so customers can easily verify privacy practices. United States data residency All processing and storage defaults to US regions, with alternative regions available on request. Employee security People-focused safeguards ensure staff act as strong defenders of customer data Background checks Pre-employment screening verifies candidates’ trustworthiness before granting any system access. Security awareness training Every employee completes training at hire and annually thereafter to stay current on threats and responsibilities. Pre-employment background checks Candidates undergo reference and suitability screening aligned with role risk before gaining access to systems. Background screening Interview, reference, and other checks are completed before onboarding to verify trustworthiness relevant to job duties. Annual security awareness training All personnel refresh their knowledge of threats, policies, and secure practices each year, fostering a security-first culture. Pre-employment reference checks Candidates undergo reference verification proportional to role sensitivity before gaining access to systems. Confidentiality agreements Employees and contractors formally commit to protecting proprietary and customer information. Standards of conduct acknowledgment Employees must read and sign the code of ethics and information security program on hire and annually thereafter. Centrally managed endpoints Mobile-device management enforces encryption, patching, and endpoint detection across all corporate devices. Standards of conduct acknowledgement Personnel must read and sign the code of conduct and information security program on hire and annually. Centrally managed devices MDM enforces encryption, strong passwords, screen-lock and EDR software on every corporate endpoint. Managed device compliance Workstations are required to have current patches, antivirus, and mobile-device management enforcement before connecting to resources. Formal performance accountability Security responsibilities are embedded in job descriptions and annual reviews, ensuring individual accountability for control adherence. Secure workstation requirements Laptops must run up-to-date OS patches, antivirus software and full-disk encryption before connecting to production resources. Performance and accountability reviews Annual evaluations incorporate security responsibilities, reinforcing individual accountability for controls. Annual performance reviews Managers formally evaluate each team member’s adherence to security responsibilities, reinforcing accountability. Business continuity Proven recovery capabilities minimize downtime and data loss during disruptive events Documented BC/DR plan A comprehensive continuity strategy defines procedures, roles and recovery objectives for critical services. Documented disaster recovery plan Recovery objectives, roles, and step-by-step procedures are defined and reviewed annually to ensure readiness. Documented business continuity plan Plans outline recovery objectives, roles, and communication steps to maintain critical operations during adverse conditions. Documented BCDR plan Business continuity and disaster recovery procedures are reviewed, approved and tested every year. Annual recovery testing Backup restoration and continuity drills validate that critical data and services can be brought back within target timeframes. Annual BCDR testing Recovery procedures and backups are exercised yearly to confirm they meet recovery time and point objectives. Multi-availability-zone deployment The platform runs in fault-tolerant cloud zones so a regional outage does not disrupt operations. Encrypted automated backups Customer data is backed up automatically, encrypted and monitored for successful completion. Automated daily backups System data is backed up every day and replicated to separate zones, protecting against data loss and local failures. Geographically segregated backups Data replicas reside in distinct zones so information remains recoverable even if a region experiences an outage. Regular backup integrity testing Annual restore tests verify backups can be successfully recovered when needed. Backup restoration validation Periodic restore tests confirm that backup data can be successfully recovered when needed. Cyber insurance coverage A dedicated cyber policy provides financial resilience against business interruptions and incident-related costs. Cybersecurity insurance Financial coverage is in place to offset operational and customer impacts of severe security incidents or outages. Automated cross-zone backups Production data is continuously replicated to separate zones, reducing RPO to near-zero. Risk mitigation planning The organization identifies disruption risks and develops mitigations as part of its broader risk management program. Public incident history and uptime Customers can track historical availability and incident reports, underscoring transparency and reliability. AI governance Contractual, technical and procedural controls ensure responsible and secure use of artificial intelligence Zero data retention agreement A signed amendment with OpenAI mandates that customer content is neither stored nor used for human review. No customer data model training Production AI models are not trained on customer inputs or outputs, eliminating cross-tenant data leakage and intellectual-property exposure. Prohibition on training with customer data Models are not trained on customer content unless an exclusive, customer-requested arrangement exists. Zero-retention model providers Foundational model partners are contractually bound to discard all prompts and outputs after processing and to prohibit human review. US-only AI processing Inference workloads run within United States regions, helping customers satisfy strict data-residency or export-control requirements. Approved use-case governance Each AI use case undergoes provider review, and scope changes require re-approval to maintain low risk. Customer-exclusive model option Organizations that require bespoke models can opt for a separate training track with contractual assurances of isolation and data ownership. Ban on provider human review Contracts forbid AI partners from manually inspecting any customer inputs or outputs, protecting confidentiality. Risk management Structured assessments identify, prioritize, and drive remediation of threats across the organization. Annual enterprise risk assessment Management documents threats, impact and mitigation strategies at least once per year to guide control priorities. Formal risk management program Documented methodology identifies, scores, and tracks risks, ensuring mitigation strategies receive appropriate resources. Quarterly security risk reviews A cross-functional team reassesses emerging risks each quarter to keep the program aligned with a changing landscape. Quarterly risk review meetings Security leadership meets every quarter to review emerging threats and adjust controls, maintaining relevance as the business evolves. Fraud risk assessment Evaluations consider incentives, opportunities, and potential fraud scenarios, embedding anti-fraud measures into the control framework. Fraud risk analysis Risk assessments explicitly consider incentives, opportunities and attitudes that could lead to fraud or misconduct. Risk-based control selection New controls are chosen and adapted based on quantified risk ratings, ensuring resources focus on greatest exposures. Integrated control selection process Risk assessment results directly inform which new technical and procedural controls are designed each year, tying investments to real threats. Cyber insurance coverage Financial risk is further mitigated through a dedicated cybersecurity insurance policy. No documentation available No subprocessors available Updates Aug 25, 2026 Now certified under UK Cyber Essentials Plus Peregrine is now certified under UK Cyber Essentials Plus, a UK government-backed cybersecurity certification that includes independent testing. The certification covers the security of our systems and processes. Reviewers can reference it directly in our trust center. Apr 23, 2026 Compliance FedRAMP High Authorization Peregrine has completed FedRAMP High Authorization in conjunction with our partner Knox Security Nov 15, 2025 Compliance ISO 27001 Certification Peregrine has completed ISO 27001 certification through our third-party auditor, A-LIGN. Nov 15, 2025 General SOC-2 Type II Audit Completed (October 2025) Peregrine has successfully completed its 2025 SOC 2 Type II audit. The independent auditor issued the report with no qualified opinions, exceptions, or derogatory findings. This outcome confirms that the controls supporting security, availability, and confidentiality were designed appropriately and operated effectively throughout the entire audit period. For customers and partners, this provides independent assurance that Peregrine's security and compliance practices are not only documented but consistently executed. The results demonstrate strong operational discipline, effective oversight of our cloud infrastructure and supporting processes, and mature governance practices aligned with the AICPA Trust Services Criteria. Organizations with a legitimate interest in reviewing the audit report may request a copy through their Peregrine contacts. Peregrine empowers the people who protect our communities by transforming fragmented public-safety data into clear, actionable intelligence. In complex, interconnected information ecosystems, failures rarely announce themselves. They accumulate through small, quiet missteps: overly permissive access rules, inconsistent retention enforcement, broken audit trails. Peregrine has been designed at every level of the platform to eliminate these risks, so customers can protect their data through the entire life cycle with total ownership and control at all times in a transparent, secure, and compliant ecosystem. See the Overview tab for certification badges, grouped under Security Standards and Industry and Regulatory. Data ownership and access Ownership: customers maintain full ownership and control of their data at all times. Peregrine never collects, sells, or repurposes customer information. Retention and deletion: customers apply the retention and deletion rules they choose, so data is kept only as long as required. Role- and attribute-based access controls (RBAC and ABAC) enforce least-privilege access down to the row and field level, including field-level redaction of sensitive data. Purpose-bound data sessions require explicit, just-in-time justification at the moment of use, with every access logged alongside full contextual metadata for audit and review. Access policy engine: access rules are authored in Cedar, an open-source, domain-specific policy language, verified against real users and data before going live, with every evaluation logged with the exact code that ran and the result. Transparency Immutable records of platform actions: detailed audit logs record user-level actions such as access, exports, and transformations with identity and timestamp metadata, so organizations can reconstruct who did what, when, and where. Lineage and provenance: organizations can trace how data is ingested, transformed, and consumed, and capture where data originates and how it was derived. Anomaly detection and alerts: push notifications for admins identify suspicious activities such as privilege escalation, new user activity, or suspicious logins. Governance, security, and compliance FedRAMP High authorized platform: Peregrine is FedRAMP High authorized and operates within AWS GovCloud environments, providing validated security controls, continuous monitoring, and data sovereignty protections required for sensitive government workloads. Independently audited and certified: Peregrine maintains a SOC 2 Type II attestation and has completed ISO 27001 certification through third-party auditor A-LIGN. The platform also supports HIPAA and HITRUST compliance requirements for handling protected health information. CJIS alignment: the architecture is purpose-built for regulated environments, incorporating least-privilege access, strong identity controls, and continuous security monitoring aligned with CJIS, HIPAA, and federal security expectations. Modern encryption standards: data is protected in transit using TLS 1.3 with FIPS 140-3 validated cryptographic modules and AES-256 encryption. Data at rest is encrypted using AES-256 in accordance with FIPS 197 standards. Centralized identity enforcement: Peregrine integrates directly with customer identity providers using Single Sign-On, and Multi-Factor Authentication is always required in non-SSO environments. Sovereignty: data is securely stored and processed within approved domestic jurisdictions, helping international, federal, state, and local organizations meet data residency requirements. Responsible AI Data privacy as a foundation: AI models are not trained on customer data, ensuring proprietary and sensitive information remains isolated and protected. Controlled AI access: granular permissions define who can build, modify, enable, and use AI-driven workflows. AI workflows must be enabled by the customer and all AI outputs are clearly labeled. End-to-end provenance: AI outputs have comprehensive lineage to show reasoning and cite data sources, with links back to underlying evidence for verification by users. Human-in-the-loop safeguards: critical decisions remain under human control, with Peregrine's AI workflow tools acting in an assistive capacity only. Vulnerability disclosure Peregrine accepts vulnerability reports through its public reporting form: Report a vulnerability. Contact For questions about Peregrine's security and compliance posture, contact compliance@peregrine.io. Audit reports and certifications are available under Resources, and common questions are answered in the FAQ. Answers below are published by Peregrine. For audit reports and certifications, see Resources. Question Answer Is Peregrine compliant with the FBI CJIS Security Policy? Yes, Peregrine remains committed to maintaining Administrative, Technical and Physical controls to comply with the latest requirements within the FBI CJIS Security Policy. While there is no vendor compliance accreditation for CJIS, Peregrine has been reviewed and approved by the CJIS Security Agencies for agencies located in California, New Mexico, Texas, Florida, Georgia, and Virginia. Is Peregrine compliant with HIPAA? Yes, Peregrine is compliant with HIPAA privacy and security rules and currently serves multiple agencies under a Business Associate Agreement in order to integrate ePHI data along with other public safety and CJI data in order to provide a comprehensive picture and informed response to public safety incidents and trends while ensuring the appropriate disclosure of relevant details to those who need it. Overview