has to hold up.
Qualification records are operational and legal documents. QValor's security architecture was designed accordingly — from the encryption stack to the chain of custody model to the cryptographic integrity layer.
Architecture Language: QValor is designed to align with these standards and built toward these compliance postures. Formal certifications (SOC 2 Type II, CJIS audit) are pursued as the platform moves from development to full institutional deployment. "Designed to align with" is not equivalent to "certified under."
Every compliance decision in QValor traces to the specific regulatory and institutional requirements of law enforcement data handling, armed security operations, and defensible qualification documentation.
CJIS Alignment
HIPAA-Ready
SOC 2 Pathway
ADA Title II
Electronic Signatures
All data moving between the mobile app, web console, and QValor servers is encrypted using TLS 1.3 — the current industry standard for transport security.
All stored data — qualification records, target images, officer profiles, and training history — is encrypted at rest using AES-256. Local mobile storage encrypted with the same standard.
Accommodation and medical data is architecturally isolated under a separate encryption key from the main data store. The access model requires a separate permission flag and logs every access event. Key rotation cadence is established at institutional deployment.
Target images are stored as encrypted blobs. Decryption requires an authenticated API call. EXIF data — including timestamp and capture metadata — is preserved as part of the evidence record.
Every QValor user operates within a defined role with granular access controls. No user has access to data beyond what their role requires. All access is logged.
- Multi-factor authentication (MFA) architecture required for all admin and instructor accounts.
- Role-based access control (RBAC) with granular permission sets per role — no user accesses data beyond their defined scope.
- Medical/accommodation data isolated behind a separate permission flag with access logging on every event.
- Session timeout designed for 30-minute inactivity threshold.
- Failed-login lockout architecture: 5 attempts triggers 15-minute lockout.
- IP allowlisting capability designed for high-security agency deployments.
Digital Signatures
Offline Security
The integrity layer in QValor is not just about security. It is about the evidentiary value of the qualification record itself.
Once a record is finalized and instructor-confirmed, a cryptographic hash is applied. Any subsequent modification — even a single character — produces a different hash. The original record can be independently verified at any time.
Score corrections require a documented reason code, supervisor authorization, and an audit entry. The original record is never deleted — it is superseded with a traceable correction chain visible to command and compliance roles.
The raw target image and the computer vision annotated scoring overlay are stored as separate files within the same record. The original target capture is never overwritten by the scoring layer.
- Target images, signature images, and override photos stored in encrypted object storage (S3-compatible).
- CDN for reliable global access to qualification records.
- Virus scanning on all uploaded content.
- Image compression pipeline preserving evidentiary value while reducing storage cost.
- EXIF data preservation on all target capture images.
- Automatic watermarking on target images: timestamp, officer badge, qualification ID.
- Agency-configurable retention policy.
The QValor mobile app operates offline-first. Qualification sessions are captured and stored locally with AES-256 encryption, then synced automatically on reconnect. Minimum 100 sessions cached. Photos queued for upload with progress visibility.
- 100+ offline sessions cached locally.
- Chronological sync order on reconnect.
- Medical accommodation data not cached locally.
QValor infrastructure is designed for the uptime and data integrity requirements of LE operational systems. Redundant storage, CDN-accelerated record access, and automated sync validation on every session upload.
QValor can provide a security architecture briefing for agency IT, procurement, and legal teams evaluating the platform. Full technical documentation is available under NDA for institutional prospects.