Security and data handling

Where the system runs

CivicRelay runs on infrastructure operated by IT-Empowered: a self-hosted PostgreSQL database behind an application server that is the only thing permitted to talk to it. The browser never reaches the database, the AI provider, or any legislature's API directly — every request goes through the application server, which is where authorization is enforced.

All traffic is served over HTTPS, and the application's own connection to the database is TLS-encrypted as well, so data is protected in transit on both legs rather than only at the edge. Session cookies are HTTP-only, marked Secure in production, and set to SameSite=Lax so a cross-site request cannot ride an existing session.

Authentication endpoints are rate-limited per IP to blunt credential-stuffing, email addresses are verified before an account is usable, and an administrator can require a password change on next sign-in.

How one organization's data is kept from another

Every record that belongs to a customer carries an organization identifier, and every query for such a record filters on the organization of the person making the request. The organization is not taken on the client's word: it arrives as a request header and is then validated against active membership before anything is read or written.

Legislative data — bills, versions, sponsors, hearings, and the plain-English analysis of what a bill does — is shared reference data with no organization attached, because the text of a bill is the same for everyone. Your organization's impact analysis, positions, assignments, reviewer responses and internal notes are organization-owned and are never shared, compared, or aggregated across customers.

That isolation is enforced in one authorization layer that every request passes through, rather than being re-implemented on each screen — and it is covered by automated tests that run on every change to the codebase, including tests that walk each user role through its real workflow and assert what it cannot reach. We would rather show a procurement reviewer the tests than the adjective.

Who can see what, inside your organization

Access is role-based, and roles are granted per organization by your own administrators — a person can hold different roles in different organizations. The roles are administrator, executive, executive deputy, legislative coordinator, subject-matter expert, advocacy user, and read-only.

• Read-only means read-only: the server refuses every write, not just the buttons that are hidden.
• Removing someone deactivates their access immediately while preserving the authorship of work they already did.
• Sensitive actions — role changes, position decisions, executive overrides, sends — are written to an audit log.
• An administrator account can be disabled centrally, which blocks every request and revokes existing sessions rather than waiting for them to expire.

External reviewers who do not have an account respond through a single-use link that expires, is stored only as a hash, and is scoped to one assignment. It grants access to that one review and nothing else.

AI processing

AI processing is performed server-side through OpenAI's API. The API key exists only on the server and is never exposed to the browser. What is sent is the bill text being analyzed and, for impact analysis, a description of your organization that your administrators control.

• Your data is not used to train AI models.
• Every AI interpretation of bill text carries a verbatim citation to the provision it came from, and claims that cannot be matched to the bill text are dropped rather than shown.
• Bill Q&A answers are labelled as stated explicitly in the bill, inferred, or not available.
• Impact analysis for a category of organization — for example cities and towns — is generated once from the bill text and the category, never from any individual customer's information, and is labelled as written for the category rather than for you.

CivicRelay is decision support. It does not provide legal advice, and important conclusions should be verified against the official bill text, which is always one click away.

Support access

Support staff can view the product as one of your roles, or operate it as a specific user, in order to reproduce a problem you have reported. Both are constrained rather than trusted: the role preview can only ever reduce what is reachable, and operating as a user re-checks on every single request that the session is still valid, still yours, and has not expired. Every write made that way is recorded in the audit log against the real person who made it, not the account they were using.

Backups and continuity

The database is backed up nightly at 02:30, compressed and timestamped, with fourteen days of retention. Restores are tested as part of operating the system rather than assumed to work.

Your data is yours

Organization administrators can export their organization's data at any time and can request its deletion. Legislative source data — the bills themselves — comes from public state legislature systems and remains public record. See the privacy policy for the full statement.

Reporting a problem

If you believe you have found a security issue, email security@civicrelay.io before disclosing it publicly, and we will work the problem with you. We will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it.

Reports about a specific organization's data should come through that organization's administrator so we can verify the request.