Security

Faction Four builds Smart Squad for law enforcement agencies across Canada and the United States. The information our customers trust us with is among the most sensitive there is, and we treat the security of the platform accordingly.

If you have found a security vulnerability in Smart Squad or in any Faction Four system, we want to hear from you.

How to report

Email security@factionfour.com.

Please include enough detail for us to reproduce the issue — the affected URL or component, the steps you took, and what you observed. A short description is fine; you do not need to write a formal report.

Please do not include criminal justice information, personal data, or any customer records in your report. A description of the issue is enough for us to investigate. If demonstrating the issue would require sharing that kind of data, tell us and we will arrange a secure way to discuss it.

What we commit to

We will acknowledge your report within 5 business days.
We will provide an initial assessment within 10 business days, telling you whether we have reproduced the issue and what we intend to do about it.
We will keep you informed as remediation progresses, rather than going quiet after the first reply.
We will let you know when the issue is resolved.

We assess every report on the same severity scale we use internally, and remediate on the same timetable. Reports from outside do not go into a slower queue than issues we find ourselves.

Working with us in good faith

We will not pursue legal action against anyone who reports a vulnerability in good faith, provided you:

do not access, modify or extract data beyond what is necessary to demonstrate the issue;
do not degrade, disrupt or reduce the quality of the service for anyone else;
do not use social engineering, physical attacks, or attacks against our staff or customers;
give us a reasonable opportunity to resolve the issue before disclosing it publicly.

If you follow those, we will treat your report as authorised research and work with you.

Scope

In scope: the Smart Squad application, its published web endpoints, its mobile clients, and Faction Four's public-facing systems.

Out of scope: the internal networks and systems of our customer agencies. Those belong to the agencies themselves, and we cannot authorise testing against them. If you believe you have found something affecting a specific agency, report it to us and we will coordinate with them.