Skip to main content
EMP INTAKE · SECURITYLAST UPDATED 4 SEPTEMBER 2026
Security & disclosure

Local-first by default. Three documented egress points.

In plain terms: your evidence stays on your machine. Limited network activity can occur for license activation or validation, update checks when enabled, and map-resource requests to a Falcrex-controlled map delivery service when map views, Timeline Recon playback, or exports use online basemaps. None of those carry your case content. This page is the operational detail; the legal docs live in the Privacy Policy, the Terms of Service, and the EMP Intake EULA and Support & Updates Policy.

§1

Architecture summary

EMP Intake Workstation is a standalone Windows desktop application, licensed per workstation and usable as a shared local workspace by authorized users of that machine. The case database is a local SQLite file, and evidence (preserved originals) lives in storage you control on the workstation. In normal standalone use, most case records, files, metadata, and evidence stay on your own device unless you export, sync, submit, or share them through a separate process.

EMP Intake Teams takes that same handling multi-user: the case database moves to a PostgreSQL server that your organization stands up and runs, on hardware you already manage. Teams will be a limited pilot to start. See EMP Intake Teams for the current status.

§2
Data residency & egress

Three outbound request types, none carrying case content. Everything else stays inside your boundary.

Your case data, file content, and operational metadata never leave the environment you control. There is no cloud sync, no automatic backup to our servers, and no telemetry of case-level data. Falcrex does not collect product usage analytics. EMP Intake makes three kinds of network request: license activation or validation, update checks when enabled, and map-resource requests to a Falcrex-controlled map delivery service using Cloudflare infrastructure.

EGRESS 1 · LICENSE ACTIVATION

A periodic HTTPS call to the Cryptlex licensing endpoint to verify your license is in good standing. The payload is your license key plus a hardware fingerprint. No file paths, no filenames, no case data, no content.

EGRESS 2 · UPDATE CHECK

When update checks are enabled, EMP contacts the update server to see whether a newer build is available. The request carries no file paths, no filenames, no case data, and no content. This egress is optional and can be controlled.

EGRESS 3 · MAP DELIVERY

When map views, Timeline Recon playback, or exports use online basemaps, EMP loads OSM-derived Protomaps vector basemaps through a Falcrex-controlled map delivery service using Cloudflare infrastructure.

§3

Integrity model

Every file ingested by EMP Intake is hashed with SHA-256 on arrival and the original is preserved and hash-verified as the canonical record. Supported case actions are recorded in the audit log, and the export package carries a hash manifest. Someone reviewing the case later can run the hash themselves and see whether a file changed, without EMP installed.

EMP’s handling is designed to align with NIST SP 800-86 (integrating forensic techniques into incident response) and NIST SP 800-101 (mobile device forensics), for handling and exporting mobile-device evidence acquired elsewhere, not on-device extraction. See Defensible by Design for the full model.

EMP Intake is designed to support defensible evidence workflows. Hashing is tamper-evident, not tamper-proof, and admissibility is decided by the court. “NIST-aligned” describes a design target, not a certification.

§4

Encryption, storage & security posture

In transit, the licensing and map delivery endpoints are reached over HTTPS. At rest, EMP recommends full-disk encryption (BitLocker or equivalent) on workstations running EMP Intake.

Customers are responsible for protecting local devices, administrator credentials, exported files, backups, external storage locations, and evidence handling and access controls within their own environment. Falcrex does not undertake responsibility for maintaining customer backups unless Falcrex expressly provides a separate paid backup or hosted service in writing.

On certifications: EMP Intake Workstation runs on your machine, and that local-first design is our security model today. With no multi-tenant cloud of ours holding your evidence, most of a standard vendor security questionnaire simply does not apply: your case data never leaves your PC. We are not SOC 2 or ISO 27001 certified. Formal third-party attestations are on the roadmap as EMP Intake Teams matures. Until then, the architecture documented on this page is the assurance, and you can verify it yourself.

§5

Third-party components

EMP Intake includes or depends on the following third-party components. Required notices and attributions are provided in the THIRD-PARTY-NOTICES file distributed with the software.

The cloud services behind the website, licensing, payments, and email are separate from these bundled components; each one is listed with what it touches on the sub-processors page.

ComponentPurposeLicense
CryptlexLicense activation and edition validation.Vendor agreement
Protomaps / OpenStreetMapsOSM-derived Protomaps vector basemaps for the incident-reconstruction view, delivered through a Falcrex-controlled map delivery service using Cloudflare infrastructure. ODbL / OSM terms
FFmpegMedia probing and fallback media processing. LGPL 2.1+ builds, distributed without the GPL-licensed components.LGPL 2.1+
SQLiteLocal embedded case database on the customer’s workstation.Public domain
§6

Coordinated vulnerability disclosure

If you believe you’ve found a security vulnerability in EMP Intake or our website, please report it to us at privacy@falcrex.com with enough detail to reproduce the issue. We practice coordinated disclosure:

  • We acknowledge reports and triage them on a reasonable efforts basis.
  • We work with the reporter to validate, prioritize by severity, and develop a fix or mitigation. Some updates may be required for security, licensing, or compatibility.
  • We ask reporters to give us a reasonable opportunity to remediate before any public disclosure, and to coordinate timing with us so customers can update first.
  • With permission, we’re glad to credit reporters in release notes.

Falcrex does not operate a paid bug bounty program. Please test only against your own installation. Do not attempt to access, probe, or disrupt other customers’ data or our infrastructure. Do not include live case records, evidence files, or sensitive investigative materials in a report unless Falcrex specifically requests them and you are legally authorized to share them.

Scope

In scope: the EMP Intake WS Windows application, EMP Intake Teams, this website, and the export package and its verifier.

Out of scope: third-party services we rely on, social engineering of our staff or customers, physical attacks, and volumetric denial-of-service testing.

What to send
  • Steps to reproduce the issue.
  • The affected version (for example WS 0.9.158).
  • The impact, plus any proof of concept needed to demonstrate it.

Do not include real case files, evidence, or exploit details in the general contact or support forms. Use the security email above for anything sensitive.

Response target

We aim to acknowledge reports within 5 business days. This is a good-faith goal, not a contractual service level agreement.

Safe harbor

If you make a good faith effort to follow this policy and stay within the scope above, we will not pursue or support legal action against you for your research. Do not access, modify, or delete data that is not yours, and give us a reasonable opportunity to remediate before any public disclosure.

§7

Updates & supported versions

Falcrex may release bug fixes, patches, maintenance releases, security updates, compatibility updates, and feature updates. Some updates may be required for security, licensing, or continued support, and Falcrex may limit support for outdated, end-of-life, beta, altered, or unsupported-environment installations. Support and updates are governed by the EMP Intake Support & Updates Policy and the EULA.

§8

Customer responsibility

EMP Intake is designed to support defensible evidence workflows, but customers remain responsible for legal, regulatory, evidentiary, retention, and investigative decisions. Compliance requirements vary by deployment, jurisdiction, and use case.

EMP Intake is a tool, not legal advice, not a compliance certification, and not a substitute for counsel, accreditation, or your own internal review. It does not certify your organization’s compliance posture. No method of transmission, storage, or electronic processing is completely secure, and Falcrex cannot guarantee absolute security.

9

Current controls and roadmap

What EMP Intake does today, what it is not, and what we will publish as it is completed. We would rather you check these than take a logo on a slide at face value.

What EMP does today
  • Local-first architecture: evidence stays on the workstation.
  • SHA-256 hashing at intake.
  • Preserved original files, kept as the canonical record.
  • An append-only audit log of case actions.
  • A verifiable export package with an independent verifier.
  • A signed Windows installer at launch.
  • A coordinated vulnerability-disclosure policy.
  • Three documented network egress types, and nothing else.
What EMP is not (yet)

EMP is not SOC 2, ISO 27001, CJIS, or FedRAMP certified, and does not claim those.

Roadmap

We will publish attestations here as they are completed.

SECURITY REPORTS · privacy@falcrex.comSEE ALSO · Terms of Service · EULA · Privacy Policy · Support & Updates Policy · Sub-processors · Trust posture
Go deeper

See exactly what stays on your machine.

Run a real case through EMP Intake WS, local-first, nothing uploaded, then read exactly what we collect and what we don’t.

Start the 14-day trial, no card →Read our trust posture