Security Summary

1. What PassDown holds

Station information: rigs, equipment, station problems, alerts, handdowns, chores, shift log entries and photos, plus the names, email addresses, roles, shifts and stations of your members. PassDown isn’t designed for patient information, and our terms don’t allow it (see section 6).

2. How we protect it

• On the way: every page and request uses HTTPS, and browsers are told never to connect without it. Security headers block click-jacking and file-type tricks.
• Stored: the database is hosted by Railway, which encrypts stored data. Photos are kept in Cloudflare R2, which also encrypts stored files. Photos are never public: each view uses a private link that stops working after a few minutes.
• Secrets: passwords are hashed with bcrypt. Sign-in tokens are stored only as hashes. Authenticator keys are encrypted with AES-256.
• Departments kept apart: every page and request checks the sign-in and limits it to that person’s own department. Asking for another department’s record gets “not found.” Roles (firefighter, officer, battalion chief, department admin) decide who can change what.
• Sign-in protection: passwords are at least 10 characters. Accounts lock for 15 minutes after 5 wrong tries, and sign-in attempts are rate-limited. Each person confirms their email with a code. Two-step sign-in (an authenticator app with one-time recovery codes, or a passkey like Face ID) is required for department admins after a 14-day setup window, and for our own administrator account. Sessions end after 30 days without use and whenever a password changes. Admins get an email when their account signs in on a new device, and risky admin actions need the password typed again.
• Activity log: admin changes and security events (sign-ins, failed tries, lockouts, two-step changes) are recorded with who, when and from where. Admins can review their department’s log.
• Phones: the copy saved for weak signal is cleared when you sign out. Photos are shrunk and their location data removed before they leave the phone.
• Backups: the database is backed up on a schedule.

3. Who at PassDown can see your information

Only PassDown’s founder has administrator access to the systems that run it, and that access requires two-step sign-in. We look at a department’s information only to give support the department asks for, to keep PassDownsecure, or when the law requires it.

4. The companies we rely on

• Railway, hosting and database (SOC 2 Type II audited)
• Cloudflare, photo storage and website delivery (SOC 2 Type II, ISO 27001)
• Resend, email delivery (SOC 2 Type II)
• Stripe, payments (PCI DSS Level 1). Card and bank numbers never touch PassDown.

5. If something goes wrong

• If we confirm a security incident that affected your department’s information, we’ll tell your admins without unreasonable delay, and within 72 hours, with what we know and what we’re doing about it. We’ll help your department meet its own notice duties.
• Found a security problem? Email support@firepassdown.com with “Security” in the subject. We won’t take legal action over good-faith research that doesn’t access other people’s information, doesn’t disrupt PassDown, and gives us reasonable time to fix the problem before it’s shared.

6. HIPAA and other laws about handling information

This is a plain-language overview, not legal advice. Your department’s privacy officer or attorney decides how these laws apply to you.

HIPAA and the HITECH Act

• HIPAA’s Privacy, Security and Breach Notification Rules apply to “covered entities” and their “business associates.” Fire departments and EMS agencies that bill health plans electronically are usually covered entities. Many are “hybrid entities,” where only the EMS side is covered.
• Protected health information (PHI) is health information that can identify a patient: names, home addresses (a home address tied to a medical call counts), dates like a birthdate, phone numbers, photos that show a patient, conditions, treatments, and anything from a patient care report.
• PassDown isn’t designed to hold PHI, and we don’t sign business associate agreements (BAAs). Under federal guidance, a service that stores PHI for a covered entity becomes a business associate even if it never looks at the information. That’s why PHI has to stay out of PassDown. Our terms don’t allow it, and PassDown reminds people where they type.
• What to write instead: the run or incident number, a cross street or block instead of a house number for a medical call, and “EMS call” instead of the patient’s condition.
• If PHI gets in anyway: delete it right away (the person who posted it or an admin can), tell your department’s privacy officer, and email us if you need help, for example to remove a photo. Your privacy officer decides whether HIPAA’s breach rules apply.

State medical privacy and health data laws

• California’s Confidentiality of Medical Information Act (CMIA, Civil Code § 56 and following) protects medical information held by health care providers, health plans, their contractors, and businesses whose software is designed to keep medical information. PassDown isn’t designed for medical information, and it has to stay out for the same reasons as under HIPAA.
• Consumer health data laws, like Nevada’s (Senate Bill 370 of 2023) and Washington’s My Health My Data Act, regulate health information collected about consumers. PassDown doesn’t collect consumer health data.
• Many other states have their own medical-confidentiality laws. Keeping patient information out of PassDownkeeps you clear of those too.

Your members’ medical information

• Employers have to keep employee medical information confidential and separate from other records, under laws like the Americans with Disabilities Act (42 U.S.C. § 12112(d)), the Family and Medical Leave Act (29 C.F.R. § 825.500(g)) and California’s CMIA rules for employers (Civil Code § 56.20 and following).
• So don’t post a member’s injury, illness, test results or reason for leave. “Captain Smith is off this shift” is fine. Why isn’t.

Data security and breach notification laws

• Every state has a data breach notification law, for example Arizona (A.R.S. §§ 18-551 and 18-552), California (Civil Code § 1798.82) and Nevada (NRS 603A.220). Some states also require reasonable security for personal information, like California (Civil Code § 1798.81.5) and Nevada (NRS 603A.210).
• The personal information these laws cover, like Social Security, driver’s license or financial account numbers, medical information, or a username with its password, doesn’t belong in PassDown. The exception is sign-in details, which we protect as described above. Our 72-hour promise in section 5 helps your department meet its own deadlines.

Privacy laws for websites and apps

• The California Consumer Privacy Act (CCPA, as amended by the CPRA), California’s Online Privacy Protection Act (CalOPPA), and Nevada’s online privacy law (NRS 603A.300 to 603A.360) call for a clear privacy notice and limit selling personal information. We publish our Privacy Policy, honor access and deletion requests from anyone, don’t sell personal information, and don’t share it for advertising.
• The Federal Trade Commission holds companies to their privacy and security promises (Section 5 of the FTC Act). This summary and our Privacy Policy are those promises.
• PassDown isn’t meant for children, so the Children’s Online Privacy Protection Act (COPPA) doesn’t come into play.

Public records and record keeping

• If your department is a public agency, what it keeps in PassDown may be a public record, under laws like the California Public Records Act (Government Code § 7920.000 and following), Arizona’s public records law (A.R.S. § 39-121 and following) and the Nevada Public Records Act (NRS chapter 239), and it may fall under your records retention schedule.
• Your department decides how long PassDown keeps its information and can download copies for a request. If someone sends a records request to us, we’ll forward it to your department.

Criminal justice information

• Information from law enforcement systems, like criminal history, is covered by the FBI’s CJIS Security Policy. PassDown isn’t set up for it, so don’t enter it. General hazard notes about a location, like an aggressive dog, are fine.

7. What we don’t have yet

• An independent security audit of PassDown itself, like a SOC 2 report. Our hosting providers have theirs.
• Single sign-on with Microsoft, Google or SAML.
• A business associate agreement (see section 6).

We’re glad to fill out your department’s security questionnaire. Email support@firepassdown.com.