Security and data packet

The one page the chief's IT reviewer needs — hosting, data location, roles, retention, deletion paths, subprocessors, and backups.

For the person who decides whether the department may use this. Short on purpose; every line has a longer answer on request at hello@coffeetabletactics.com.

Question	Answer
Where does the data live?	A managed Postgres database and object storage in the United States. Every table is scoped to your department by row-level security; a member of another department cannot read your rows, even through the API.
Who can see what?	Seven roles from viewer to department admin. Viewers read; members edit; users run AI features; department admins manage the roster, invites, preferences, and billing.
Is anything public?	Only what an admin publishes: a replay share link (hashed token, revocable, purged 30 days after revoke) or a report share link. Public pages carry the address and map but never crew names, notes, or audio.
How long is it kept?	The retention table on the privacy policy, enforced by a nightly job. Retention windows are a department setting; there is no vendor default that outlives your choice.
Can we delete it?	A member deletes their own account. An admin deletes an incident, its files, or the whole department, and the files go with it.
Who else touches it?	The subprocessor table on the privacy policy names each vendor and what reaches it. Photos lose their metadata on the device before upload.
Backups?	Daily backups on the database provider; point-in-time recovery is a paid option the department can ask about.
Standards?	Coffee Table Tactics is aligned to the NFPA documents it cites (1660 pre-incident planning, 1550 post-incident analysis, 1401 training records, 1750 deployment). It is not certified by anyone and does not claim compliance. ISO and the state fire office grade the department, never the tool.

What this does not do

every permission is enforced in the database as well as the interface — but do not describe it as a security product. Department data is scoped to the department; cross-department access requires an explicit share.
a public replay link is public to anyone holding it until revoked — treat it accordingly. Sharing grants the access level chosen and no more.

Security and data packet

The one page the chief's IT reviewer needs — hosting, data location, roles, retention, deletion paths, subprocessors, and backups.

For the person who decides whether the department may use this. Short on purpose; every line has a longer answer on request at hello@coffeetabletactics.com.

Question	Answer
Where does the data live?	A managed Postgres database and object storage in the United States. Every table is scoped to your department by row-level security; a member of another department cannot read your rows, even through the API.
Who can see what?	Seven roles from viewer to department admin. Viewers read; members edit; users run AI features; department admins manage the roster, invites, preferences, and billing.
Is anything public?	Only what an admin publishes: a replay share link (hashed token, revocable, purged 30 days after revoke) or a report share link. Public pages carry the address and map but never crew names, notes, or audio.
How long is it kept?	The retention table on the privacy policy, enforced by a nightly job. Retention windows are a department setting; there is no vendor default that outlives your choice.
Can we delete it?	A member deletes their own account. An admin deletes an incident, its files, or the whole department, and the files go with it.
Who else touches it?	The subprocessor table on the privacy policy names each vendor and what reaches it. Photos lose their metadata on the device before upload.
Backups?	Daily backups on the database provider; point-in-time recovery is a paid option the department can ask about.
Standards?	Coffee Table Tactics is aligned to the NFPA documents it cites (1660 pre-incident planning, 1550 post-incident analysis, 1401 training records, 1750 deployment). It is not certified by anyone and does not claim compliance. ISO and the state fire office grade the department, never the tool.

What this does not do

every permission is enforced in the database as well as the interface — but do not describe it as a security product. Department data is scoped to the department; cross-department access requires an explicit share.
a public replay link is public to anyone holding it until revoked — treat it accordingly. Sharing grants the access level chosen and no more.