Does EMP Intake Teams have a SOC 2 report?

We do not claim a current SOC 2 report. Ask about the documented controls available for your pilot.

Where are case and audit records stored?

In the workspace you host. Case and audit records remain on your infrastructure.

Can the audit data feed my SIEM?

Audit data can be exported for review. Any SIEM connection depends on your deployment and integration tooling; confirm the required format and workflow first.

Who holds the encryption keys?

You do. EMP Intake Teams leans on your platform's own encryption, and the keys live in your environment. There is no copy on our side to lose.

Is the export format the same as EMP Intake Workstation?

Both editions provide file-based hand-offs with manifests and checksums. Follow the verification instructions for the package received; included content and options can differ.

Evidence Security at Team Scale

EMP Intake Teams applies evidence hashing, preserved originals and recorded handling to a shared workspace. Its pilot is planned for 2027 on infrastructure you control. This guide covers access, collaboration, audit records and deployment responsibilities.

1. The shared integrity model

Same objects as the standalone workstation: cases, evidence, custody events, packages, logs. Same evidence hashing, preserved-original, workflow-specific provenance, audit, and export-package principles. Recipients can review exported files and check their manifest without EMP installed. Included content and verification options depend on the export. The NIST SP 800-86 and 800-101 alignment carries over too, as a design target that shaped the build, not a certificate. SP 800-101 references concern handling and exporting mobile-device evidence acquired elsewhere, not extraction from a device.

2. What changes at team scale

The new problem is concurrency. Two investigators may open the same case. EMP shows section-level edit presence. For case details and notes, stale saves are rejected and the investigator's draft is preserved so it cannot silently overwrite a newer save. EMP does not stream live keystrokes between users. The Workspace API checks access and records supported actions with the acting user. Conflict protection depends on the editing workflow. An audit record is not a universal guarantee against conflicting edits.

3. Authentication, authorization, and encryption

Remote clients connect to the Workspace API over HTTPS. Local accounts and case permissions control access. Database transport and storage encryption must be configured and verified for your environment, with keys under your organization's control.

4. Audit-trail integrity under concurrency

Audit records are append-only through supported application workflows. Direct administrative access, retention and restore procedures remain part of your organization's controls.

5. Backups, DR, and case portability

Back up the case database and managed evidence files together, and verify recovery before relying on the backup. A case export is a hand-off artifact, not a replacement for a workspace backup.

6. Hardening and disclosure

Teams runs where your evidence already lives, so a lot of the posture is yours: network boundaries, IAM, key management, patching. We hand you the patterns we recommend and work through the environment-specific hardening with you. Formal third-party attestations and published penetration-test reports are not claims we make today.

Team security, worked through with you. EMP Intake Teams adds shared cases and role-scoped access on infrastructure you control, with the environment-specific hardening worked through together (pilot planned for 2027). Apply to the Teams pilot →

NIST-aligned, audited at the API, on your infrastructure.