Security & Data Processing
An overview of security responsibilities and data-processing practices.
Patrol Forge Multiple Company
Operated by Patrol Forge LLC
Effective Date: September 19, 2026
This Security & Data Processing Policy ("Policy") describes the administrative, technical, and organizational measures used by Patrol Forge LLC ("Patrol Forge," "we," "us," or "our") to protect information processed through the Patrol Forge Multiple Company platform, websites, applications, APIs, and related services (collectively, the "Services").
This Policy also describes the general principles governing how Patrol Forge processes information on behalf of customers using the Services.
This Policy supplements the Patrol Forge Multiple Company Privacy Policy, Acceptable Use Policy, Customer Subscription Agreement, and, where applicable, any Data Processing Addendum ("DPA") entered into between Patrol Forge and a customer.
1. SCOPE
Patrol Forge Multiple Company is designed primarily for organizations that provide dispatch, incident reporting, coordination, and related operational services to multiple security companies or other authorized organizations.
The Services may process information concerning:
Customer organizations;
Security companies serviced by customers;
Dispatch personnel;
Officers;
Supervisors;
Administrators;
Clients;
Properties and service locations;
Calls for service;
Dispatch activity;
Incident reports;
GPS and location information;
Photographs and attachments;
Communications;
User accounts;
Audit and security records; and
Other information submitted through the Services.
This Policy applies to information processed through Patrol Forge Multiple Company and the systems used to provide the Services.
2. CUSTOMER DATA
"Customer Data" means information, records, files, photographs, reports, location information, communications, or other content submitted to, stored within, transmitted through, or otherwise processed through the Services by or on behalf of a customer.
As between Patrol Forge and the customer, the customer retains its rights in Customer Data, subject to the rights Patrol Forge requires to provide, secure, maintain, and support the Services and as otherwise provided in the applicable agreement.
Patrol Forge does not acquire ownership of Customer Data merely because the information is processed through the Services.
3. CUSTOMER AND PATROL FORGE ROLES
Depending on the circumstances and applicable law, a customer may act as a business, controller, data controller, or similar entity responsible for determining the purposes and means of processing certain Customer Data.
When Patrol Forge processes Customer Data on behalf of a customer and according to the customer's instructions, Patrol Forge generally acts as a service provider, processor, data processor, or similar entity as those terms may be defined by applicable law.
Patrol Forge may independently process certain information for legitimate business purposes, including account administration, billing, security, fraud prevention, legal compliance, and operation of the Services, as described in the applicable Privacy Policy.
The specific legal roles of the parties may depend upon the circumstances and applicable law.
4. CUSTOMER RESPONSIBILITIES
Customers are responsible for determining whether they have a lawful basis and appropriate authority to collect, submit, access, use, disclose, and otherwise process Customer Data through the Services.
Customers are responsible for:
Obtaining required notices, permissions, and consents;
Maintaining appropriate contracts with companies they service;
Determining who should have access to Customer Data;
Configuring User permissions appropriately;
Maintaining accurate User accounts;
Promptly removing access when no longer required;
Ensuring Customer Data is collected and used lawfully;
Establishing appropriate retention requirements;
Responding to applicable privacy requests where the customer controls the information; and
Complying with laws applicable to the customer's security and dispatch operations.
The availability of functionality within Patrol Forge does not independently establish that a customer's particular use of that functionality is lawful.
5. MULTI-COMPANY DATA SEGREGATION
Patrol Forge Multiple Company is designed to support customers that provide services to multiple security companies or organizations.
Patrol Forge uses logical and technical controls intended to restrict access to Customer Data according to authorized company, account, role, and User relationships.
Customers and Users must not attempt to circumvent these controls.
Information belonging to one serviced company should not be made available to another serviced company unless the customer has authorized such access and possesses the legal and contractual authority to provide it.
6. ACCESS CONTROL
Patrol Forge employs access-control mechanisms intended to limit access to information and system functionality according to authorized roles and permissions.
Depending on the applicable Service configuration, these controls may include:
Unique User accounts;
Role-based permissions;
Company-level access restrictions;
Administrative access controls;
Authentication controls;
Multi-factor authentication;
Session controls;
Authorization checks; and
Audit logging.
Customers are responsible for assigning appropriate roles and permissions to their Users.
7. AUTHENTICATION SECURITY
Patrol Forge uses authentication mechanisms intended to reduce unauthorized access.
Users are responsible for maintaining the confidentiality of their credentials and must not share individual account credentials.
Patrol Forge may require or support additional authentication measures, including multi-factor authentication, where appropriate.
Patrol Forge may restrict or suspend access when suspicious authentication activity, credential compromise, or unauthorized access is detected or reasonably suspected.
8. ENCRYPTION AND SECURE TRANSMISSION
Patrol Forge uses reasonable technical safeguards intended to protect information transmitted between supported User devices and Patrol Forge systems.
Where appropriate, communications with Patrol Forge web services are protected using industry-standard encrypted transport protocols such as HTTPS/TLS.
Sensitive credentials and authentication information are protected using appropriate security mechanisms.
No method of electronic transmission or storage can guarantee absolute security, and Patrol Forge does not represent that unauthorized access or security incidents are impossible.
9. DATA STORAGE
Customer Data may be stored on systems operated by Patrol Forge or by infrastructure providers engaged by Patrol Forge.
Patrol Forge applies reasonable safeguards appropriate to the nature of the Services and information processed.
Production information is not intended to be publicly accessible except where a customer or authorized User intentionally uses functionality designed to make particular information available to an authorized recipient.
10. LOCATION DATA
The Services may process precise or approximate location information when location-enabled functionality is used.
Location information may include:
Officer location;
Unit location;
Dispatch location;
Patrol location;
Incident location;
GPS coordinates;
Location timestamps; and
Related device information.
Location information is processed to provide authorized features such as dispatching, officer coordination, patrol verification, operational awareness, incident documentation, or other location-enabled functionality.
Customers are responsible for determining when location monitoring is permitted and for providing required notices or obtaining required consent from personnel.
11. INCIDENT REPORT INFORMATION
Incident reports may contain sensitive information, including information concerning individuals who are not Users of the Services.
Such information may include:
Names;
Contact information;
Addresses;
Statements;
Incident descriptions;
Photographs;
Vehicle information;
Property information;
Injury information;
Witness information; and
Other information relevant to an incident.
Customers should collect only information reasonably necessary for legitimate operational, contractual, safety, investigative, insurance, or legal purposes.
12. PHOTOGRAPHS AND ATTACHMENTS
The Services may permit authorized Users to upload photographs, documents, and other attachments.
Access to these materials is subject to applicable account and authorization controls.
Customers are responsible for ensuring they have appropriate authority to collect, upload, store, and disclose such materials.
Users should avoid uploading unnecessary sensitive information.
13. AUDIT LOGGING
Patrol Forge may maintain logs concerning activity within the Services for security, operational, compliance, and accountability purposes.
Depending upon the functionality involved, logs may include information concerning:
Login activity;
Account activity;
Record creation;
Record modification;
Approval activity;
Administrative actions;
Security events;
User identifiers;
Timestamps;
IP addresses; and
System activity.
Audit records may be retained for periods appropriate to their security, operational, legal, or compliance purpose.
Customers and Users must not attempt to improperly modify, conceal, disable, or circumvent audit functionality.
14. INFRASTRUCTURE SECURITY
Patrol Forge maintains reasonable measures intended to protect the infrastructure supporting the Services.
Measures may include, where appropriate:
Network access controls;
Firewalls;
Server hardening;
Access restrictions;
Security monitoring;
Software updates;
Vulnerability remediation;
Malware protections;
Logging;
Backup procedures; and
Administrative access controls.
Security measures may change as technology, threats, infrastructure, and the Services evolve.
15. SOFTWARE AND APPLICATION SECURITY
Patrol Forge incorporates security considerations into the development and maintenance of the Services.
Security practices may include:
Authentication and authorization controls;
Input validation;
Database access controls;
Dependency management;
Security updates;
Vulnerability remediation;
Code review;
Error handling;
Logging; and
Testing of security-sensitive functionality.
Patrol Forge may modify its security practices when reasonably necessary to address emerging threats or improve the security of the Services.
16. VULNERABILITY MANAGEMENT
Patrol Forge may evaluate identified vulnerabilities based upon their potential severity, exploitability, exposure, and impact.
Security updates may be prioritized according to the risks presented by the vulnerability.
Customers and security researchers who discover a suspected vulnerability should report the issue to Patrol Forge and must not exploit the vulnerability beyond what is reasonably necessary to identify and report it.
17. BACKUPS AND RECOVERY
Patrol Forge may maintain backups or other recovery mechanisms intended to support restoration following certain failures, operational incidents, or data-loss events.
Backup systems are intended primarily for service continuity and disaster recovery and should not be considered a substitute for customer-specific record-retention or archival obligations.
Patrol Forge does not guarantee that every individual record can be restored from backup.
18. SECURITY INCIDENT RESPONSE
Patrol Forge maintains processes for responding to suspected security incidents.
Depending upon the circumstances, incident response may include:
Identification and investigation;
Containment;
Assessment of affected systems and information;
Remediation;
Recovery;
Preservation of relevant evidence;
Documentation; and
Notification where required by applicable law or contract.
Patrol Forge may temporarily restrict access to systems, accounts, integrations, or functionality where reasonably necessary to contain or investigate a security incident.
19. DATA BREACH NOTIFICATION
If Patrol Forge determines that a security incident involving Customer Data requires notification under applicable law or a binding contractual obligation, Patrol Forge will provide applicable notification in accordance with those requirements.
Notification may include information reasonably available concerning:
The nature of the incident;
The categories of information involved;
Known or reasonably anticipated effects;
Remediation measures; and
Steps the customer may consider taking.
Information may be provided in stages as an investigation progresses.
Patrol Forge will not delay reasonable security remediation solely because an investigation or notification process remains ongoing.
20. SUBPROCESSORS AND SERVICE PROVIDERS
Patrol Forge may engage third-party service providers or subprocessors to assist in providing the Services.
These providers may perform functions such as:
Infrastructure hosting;
Data storage;
Email delivery;
Payment processing;
Monitoring;
Security;
Customer support; or
Other technical or operational services.
Where required, Patrol Forge will impose appropriate contractual obligations on subprocessors that process Customer Data on Patrol Forge's behalf.
Patrol Forge may maintain a separate Subprocessor List identifying material subprocessors used in connection with the Services.
21. DATA PROCESSING INSTRUCTIONS
Where Patrol Forge acts as a processor on behalf of a customer, Patrol Forge will process Customer Data according to the customer's documented instructions, except where processing is otherwise permitted or required by applicable law.
The applicable Customer Subscription Agreement, DPA, configuration of the Services, and customer's authorized use of the Services may constitute documented processing instructions.
Patrol Forge is not required to follow instructions that would require unlawful processing or compromise the security or integrity of the Services.
22. PURPOSE LIMITATION
Patrol Forge processes Customer Data as reasonably necessary to:
Provide the Services;
Authenticate Users;
Process dispatch activity;
Maintain incident reports;
Provide requested functionality;
Maintain account and company relationships;
Secure the Services;
Prevent fraud and abuse;
Provide technical support;
Maintain backups;
Troubleshoot technical problems;
Comply with legal obligations; and
Enforce applicable agreements.
Patrol Forge will not use Customer Data for materially unrelated purposes except as permitted by applicable law and the applicable agreements.
23. SALE OF CUSTOMER DATA
Patrol Forge does not sell Customer Data in exchange for monetary consideration.
Patrol Forge does not provide Customer Data to third parties for their independent use merely because the information is processed through the Services.
Information may be disclosed to authorized service providers, subprocessors, customer-designated recipients, or other parties as described in the Privacy Policy, applicable agreements, or as required by law.
24. DATA MINIMIZATION
Patrol Forge encourages customers and Users to collect and submit only information reasonably necessary for legitimate business, operational, safety, contractual, or legal purposes.
Customers should avoid entering sensitive personal information into free-text fields when that information is not reasonably necessary for the applicable record.
25. DATA RETENTION
Customer Data may be retained for the period necessary to provide the Services and according to applicable contractual, operational, security, backup, and legal requirements.
Certain information may remain after account termination when retention is reasonably necessary for:
Legal compliance;
Litigation or anticipated litigation;
Evidence preservation;
Security investigations;
Fraud prevention;
Enforcement of agreements;
Financial or accounting obligations;
Backup integrity; or
Establishment, exercise, or defense of legal claims.
Retention periods may vary depending upon the type of information and reason for retention.
26. CUSTOMER DELETION REQUESTS
Subject to applicable agreements and legal requirements, customers may request deletion of eligible Customer Data.
Deletion may not result in immediate removal from all backup systems.
Information contained within backups may remain until the applicable backup is overwritten, rotated, or otherwise deleted according to Patrol Forge's backup practices.
Patrol Forge may retain information where deletion would conflict with applicable law, a valid preservation obligation, security requirements, or the establishment, exercise, or defense of legal claims.
27. DATA EXPORT
Where supported by the Services or required by an applicable agreement, customers may export certain Customer Data.
Customers are responsible for protecting exported information after it leaves Patrol Forge-controlled systems.
Patrol Forge is not responsible for the security of information downloaded, exported, emailed, printed, transferred, or otherwise removed from the Services by an authorized User or customer.
28. TERMINATION OF SERVICE
Following termination or expiration of a customer's Services, access to Customer Data may be restricted or disabled according to the applicable agreement.
Customers are responsible for exporting information they are required to retain before applicable deletion periods expire.
Patrol Forge may subsequently delete or anonymize Customer Data subject to applicable contractual, legal, security, and backup requirements.
29. DATA SUBJECT AND PRIVACY REQUESTS
When Patrol Forge processes personal information on behalf of a customer, the customer is generally responsible for responding to requests from individuals concerning that information.
Where legally required and reasonably practicable, Patrol Forge will provide appropriate assistance to customers in responding to valid privacy requests involving Customer Data processed by Patrol Forge.
Patrol Forge may direct individuals to the applicable customer when the customer controls the information involved.
30. LEGAL REQUESTS FOR INFORMATION
Patrol Forge may disclose information when required by valid legal process, including subpoenas, warrants, court orders, or other legally enforceable requests.
Patrol Forge may evaluate legal requests and may object to requests that it reasonably determines are invalid, overbroad, or otherwise legally deficient.
Where legally permitted and appropriate, Patrol Forge may notify an affected customer before disclosing Customer Data in response to compulsory legal process.
31. EMPLOYEE AND CONTRACTOR ACCESS
Access to production systems or Customer Data by Patrol Forge personnel or authorized contractors is limited to individuals who reasonably require such access for legitimate purposes.
Such purposes may include:
Technical support;
Security;
Infrastructure administration;
Troubleshooting;
Incident response;
Legal compliance; and
Service maintenance.
Access may be subject to authentication, authorization, confidentiality, and logging controls appropriate to the nature of the access.
32. CUSTOMER SECURITY RESPONSIBILITIES
Security is a shared responsibility.
Customers are responsible for maintaining appropriate security within their own environments, including:
Protecting User credentials;
Requiring appropriate authentication practices;
Managing User permissions;
Removing former personnel;
Protecting devices used to access the Services;
Maintaining appropriate endpoint security;
Training personnel;
Reviewing suspicious activity;
Protecting exported Customer Data; and
Promptly reporting suspected unauthorized access.
Patrol Forge is not responsible for unauthorized access resulting from customer actions or failures outside Patrol Forge's reasonable control, subject to applicable law and contractual obligations.
33. SECURITY OF USER DEVICES
Customers should ensure that computers, smartphones, tablets, and other devices used to access Patrol Forge are reasonably secured.
Recommended measures include device passwords or biometric authentication, current operating-system updates, automatic device locking, encryption where available, and appropriate malware protections.
Users should promptly report lost or stolen devices that may contain active Patrol Forge sessions or credentials to their organization.
34. THIRD-PARTY INTEGRATIONS
Customers may choose to connect Patrol Forge to third-party systems or services.
When a customer authorizes such an integration, information may be transmitted to or received from that third party.
Customers are responsible for evaluating third-party services they choose to use and for ensuring they possess appropriate authority to transfer information to those services.
Third-party systems are governed by their own security and privacy practices.
35. NO GUARANTEE OF ABSOLUTE SECURITY
Patrol Forge uses reasonable measures designed to protect information, but no information system can be guaranteed to be completely secure.
Patrol Forge does not warrant that the Services will be immune from every vulnerability, attack, unauthorized access attempt, hardware failure, software defect, or other security event.
Nothing in this section limits responsibilities that cannot lawfully be excluded or limited.
36. SECURITY TESTING BY CUSTOMERS
Customers must not conduct penetration testing, vulnerability scanning, automated security testing, load testing, or similar testing against Patrol Forge production systems without prior written authorization from Patrol Forge.
This restriction is intended to prevent unauthorized testing from interfering with the security, stability, or availability of the Services.
Good-faith vulnerability reports may be submitted to Patrol Forge.
37. CHANGES TO SECURITY MEASURES
Security practices evolve as technologies, threats, regulatory requirements, and the Services change.
Patrol Forge may modify its technical and organizational safeguards from time to time, provided that Patrol Forge does not intentionally materially reduce the overall security of the Services during an active subscription without a legitimate operational, legal, or security reason.
38. RELATIONSHIP TO DATA PROCESSING ADDENDUM
Where Patrol Forge and a customer enter into a separate Data Processing Addendum, the DPA governs the parties' contractual obligations concerning processing of personal information within its scope.
This Policy provides general information about Patrol Forge's security and data-processing practices and does not replace a separately executed DPA.
If this Policy conflicts with an executed DPA or Customer Subscription Agreement, the applicable executed agreement controls to the extent of the conflict.
39. CHANGES TO THIS POLICY
Patrol Forge may update this Policy to reflect changes in the Services, security practices, technology, legal requirements, or data-processing practices.
The Effective Date will be updated when appropriate.
Where required by applicable law or contractual obligations, Patrol Forge will provide notice of material changes.
40. CONTACT INFORMATION
Questions concerning security or data processing may be directed to:
Patrol Forge LLC
P.O. Box 20431
Albuquerque, NM 87154
United States
Privacy inquiries:
privacy@patrolforge.com
Suspected security incidents or vulnerabilities should be reported through Patrol Forge's designated security or support contact.
Formal legal notices must be submitted in accordance with the applicable Customer Subscription Agreement and Patrol Forge Legal Center requirements.
© 2026 Patrol Forge LLC. All rights reserved.