Written September 23, 2026. Plain language, because a chief and an IT director should be able to read the same page.
PatrolDesk runs on incident data a department has already published to its open-data portal. That data is public before it reaches us, and it is the only data the product uses. The application itself is a set of static files that run in the browser: there is no account to create, no database of department records on our side, and no server that processes a department's data. When you open the tool, your browser loads the data file and does every calculation itself. Close the tab and nothing remains anywhere but your machine.
Three things live only in your browser, and never reach us: the ledger of recorded orders, the watch model you edit under STAFFING, and any camera list you load. They are kept in the browser's own storage on that computer, they are not written into shared links or exports unless you choose to include them, and clearing the browser's site data removes them. A shared link carries filter settings — city, window, area, category, view — and nothing else. A CSV export or a printed order contains exactly what was on the screen.
The site and the tool are served over HTTPS. The tool makes three kinds of outbound request: basemap tiles from OpenFreeMap, Google 3D tiles and stored imagery when you open LOOK AT THE BLOCK, and Google Fonts. Each carries a request for map tiles or fonts, not your data, and the Google keys are browser keys for map tiles and imagery, nothing else. There are no analytics scripts, no tracking pixels and no third-party cookies on the site or in the tool. The contact form is the one place anything is sent to us, and it sends what you typed to a mailbox, nothing more.
It does not build profiles of people, does not identify anyone, and does not use personally identifying information from any source to make a finding. It measures places and hours. Where a department's radio is public, the live layer discards medical, mental-health, overdose, sexual-assault and juvenile calls in full, removes names, and rounds addresses to the block before anything is stored or shown. We do not sell, share or license data derived from any engagement, and on termination a department can ask for any configuration specific to it to be deleted, which we complete within thirty days.
Everything above is true because everything the tool touches is already public. The moment a department wants PatrolDesk to read something that is not public — an export from its records system, a read-only calls-for-service feed, a camera list it would rather keep on a server than in one browser — the design has to change, and the first thing that changes is who can open the door. Before the first non-public feed is connected, PatrolDesk gets a login gateway in front of it. It is not built yet, it is not needed for anything on this site today, and it ships before that first feed, not after.
What it will be, so a department's IT staff can plan against it: one tenant per department, with no shared infrastructure between departments' data. Sign-in through the department's own identity provider — Microsoft Entra ID, Okta, or another SAML or OpenID Connect provider — so the department's own account rules, offboarding and password policy apply, and a local account only where a department has no provider. Multi-factor authentication required for every account, with no exception for administrators. Role-based access that matches the command structure: a watch commander sees the zone or sector they own, an analyst sees the department, an administrator manages accounts and nothing else. Sessions that expire, and an audit log of who signed in, what they opened and what they exported, kept for the department to read. Data encrypted in transit and at rest, hosted in the United States, backed up, and deleted on a schedule the agreement states. A written incident-response commitment: what we do, and how fast we tell you, if something goes wrong on our side.
A connection to a department's CAD or RMS is a different product from the one on this page, and we say so before anyone asks. Those systems carry criminal justice information, and anything that reads them falls under the FBI's CJIS Security Policy, currently version 6.1 (June 2026), and the department's state CJIS Systems Agency. That means a compliance program, not a feature: fingerprint-based background checks and security-awareness training for every person on our side who could touch the data, FIPS-validated encryption, advanced authentication, audit logging, incident response, a signed agreement with the department and its state agency, and a security review before the first record moves. It is scoped, priced and contracted separately from a public-data engagement, because the cost is real and hiding it inside a lower price would mean skipping it.
| What | Where it lives | Who can see it |
|---|---|---|
| Published incident data | Your open-data portal; a copy as a static file | Everyone already |
| Recorded orders (the ledger) | Your browser only | You, on that computer |
| Your watch model | Your browser only | You, on that computer |
| A camera list you load | Your browser only | You, on that computer |
| A shared link | Whoever you send it to | Filter settings only, no data |
| A CSV export or printed order | Wherever you put it | Exactly what was on screen |
| A contact-form message | Our mailbox | Us |
| A non-public feed (future) | Your tenant, behind the login gateway | Accounts your department authorizes |
| CAD or RMS (future) | A CJIS-compliant deployment, contracted separately | Per the agreement |
A one-page security summary for your IT director or your city's information-security office, on request. A data-flow diagram of the product as deployed for you. Source-code escrow, or a perpetual internal-use license, so the tool keeps working if we do not. Confirmation of deletion on termination. And a plain answer to any question on this page, from the contact form or hello@patroldesk.app. If you find a security problem in the site or the tool, tell us at the same address and we will answer within two business days.
PATROLDESK