Skip to content
InfiniSight AI
STRIKE AIRequest a demo

STRIKE AI security and trust

Built for the sensitivity of case data.

Every agency gets its own isolated environment. Access is authenticated and permissioned, evidence is encrypted, and security-relevant activity is recorded, so you can show who did what, and when.

Architecture

Isolation by design

STRIKE AI runs on AWS, defined entirely as infrastructure as code, with each tenant deployed into its own boundary.

STRIKE AI deployment architecture Users reach STRIKE AI over HTTPS through a web application firewall. Each agency runs in its own tenant environment: the web app, API, analysis engine, and workers run in private subnets with no public IP addresses, evidence is stored in a KMS-encrypted data lake, secrets are KMS-encrypted, and every security-relevant action is written to an append-only audit trail. The database is reached over private network peering, and AI model calls go only to providers approved for that deployment. InvestigatorsBrowserMFA · passkeysEdgeHTTPS only, TLS 1.2+AWS WAFCDN + load balancerDedicated tenant environmentPrivate subnets · no public IPsWeb appAPI and access controlAnalysis engineQuery and export workersEvidence data lakeAmazon S3, KMS-encryptedPublic access blockedSecretsAWS Secrets ManagerKMS-encryptedAudit trailAppend-only eventsWho, what, when, outcomePrivate VPC peeringApplication databaseMongoDB Atlas, separate databaseper tenant
Simplified view. Each agency's environment has its own compute cluster, storage, secrets, and database; AI model calls go only to the providers approved for that deployment.

Controls

How STRIKE AI protects your investigations

Identity and access

  • Multi-factor sign-in with email one-time codes or WebAuthn passkeys
  • Explicit role permissions for investigations, data, users, and administration
  • Passwords stored only as bcrypt hashes

Tenant isolation

  • A dedicated compute cluster, storage, secrets, and database per agency
  • Hard tenant isolation is the deployment boundary
  • Service-to-service traffic stays on private networks

Data protection

  • Evidence and secrets encrypted at rest with AWS KMS
  • TLS 1.2 or higher in transit; HTTPS only
  • Storage blocks public access; files move through short-lived signed URLs

Network security

  • Application services run in private subnets without public IP addresses
  • AWS WAF with managed rule sets in front of the application
  • Database reached over private VPC peering

Audit and accountability

  • Append-only audit events: actor, action, target, time, and outcome
  • Authentication assurance and request context captured with each event
  • Evidence intake is checksummed and versioned for chain of custody

Governed AI

  • Model routing is configured per deployment, limited to approved providers
  • Deterministic guardrails on plans, steps, and model calls, with decisions recorded
  • Findings cite their sources, and people review before anything is final

Secure delivery

  • All infrastructure defined and reviewed as code (Terraform)
  • Container images are immutable and scanned on push
  • Application logs retained centrally in CloudWatch

Compliance

Where we stand, plainly

We assess STRIKE AI against the NIST SP 800-53 Rev. 5 controls in the FedRAMP Moderate baseline and keep a control-by-control readiness matrix as we close remaining gaps.

STRIKE AI is not FedRAMP authorized today, and we don't claim certifications we don't hold. If your agency has specific requirements, such as the CJIS Security Policy, we'll walk through how a deployment would meet them.

Request security documentation

See STRIKE AI work through a case like yours.

We'll walk your team through intake, agent-driven analysis, and finished briefings using representative case material.

Request a demo

Or email us at info@infinisight-ai.com