TRUST CENTER
RTIO — the Real-Time Intelligence Overlay — unifies public safety, built for agencies that own their mission and their data.
Revelio holds itself to eight commitments, the same for every agency, and states plainly where each control stands. Revelio Corp. will never sell any information. The agency owns its data and every record RTIO creates from it. Revelio owns only aggregated, de-identified data that cannot identify any agency, person, incident or location, and uses it only to operate and improve RTIO. Any company that acquires Revelio inherits these commitments. Nothing is shared without the agency's written authorization, or where the law requires it. Agency data is never used to train any AI model. The agency sets retention, and when an agreement ends the agency gets everything back before Revelio deletes it. Only screened personnel reach agency data, and only to support that agency. Agency data stays inside AWS GovCloud (US). The mission this protects is simple: equip first responders with the data they need to come home safely without ever becoming the reason data is used against the public they serve.
WHERE REVELIO IS
Sequenced, dated, and verifiable.
- Standard | Status | Target | Notes — AWS GovCloud (US) | IN PLACE | — | us-gov-west-1, multi-AZ. Single region today; second region below. — FIPS-validated cryptography | IN PLACE | — | FIPS endpoints where AWS provides them in GovCloud; tracking the FIPS 140-3 transition. — HIPAA BAA (per agency) | AVAILABLE TO EXECUTE | Before any PHI | Revelio signs a BAA with each agency. Revelio's AWS BAA covers AWS as a subprocessor and does not substitute for it. — CJIS Security Policy v6.0 | BEGINS ON SIGNING | Day of signing | Revelio signs the FBI CJIS Security Addendum with the agency and starts GBI vendor vetting the day an agreement is signed. No agency data enters RTIO until that process is complete. Revelio is not CJIS compliant today. — CJIS personnel screening | BEGINS ON SIGNING | Before any access | Fingerprint-based background checks and security awareness training through GBI's vendor program, complete before anyone reaches agency data. — First design-partner pilot go-live | IN PROGRESS | January 2027 | Nine-month pilot. Every item marked "Before go-live" is in place first. — Automated security monitoring | COMMITTED | Before go-live — Cross-region backup | COMMITTED | Before go-live | 24-hour restore objective. — Independent penetration test | COMMITTED | Before general availability — Cross-region warm standby and failover drills | TARGETED | Post-pilot | Designed, not deployed. — Multi-party approval for privileged access | COMMITTED | At second engineering hire — Privileged-access workstations | COMMITTED | At second engineering hire — SOC 2 | TARGETED | Type I Q2 2027; Type II Q4 2027 | Auditor engagement begins January 2027. — GovRAMP Core | TARGETED | Q3 2027 — FedRAMP | TARGETED | After the seed round | To support federal agency access. — ISO 27001 | TARGETED | 2028 | Shares most of its controls with SOC 2. — FirstNet Trusted / Listed | TARGETED | To be confirmed | Procurement signal, not blocking. — Legend: IN PLACE means operating today. IN PROGRESS means started, with an owner and a date. COMMITTED and TARGETED mean not yet in place. Revelio does not list an item as in place until a document, an infrastructure resource, or a passing test proves it.
HOW IT'S BUILT
AWS GovCloud (US). Deny-by-default today. Its own database for every tenancy.
TODAY: RTIO runs on AWS GovCloud (US), region us-gov-west-1, across multiple availability zones. Compute is pooled on a tenant-namespaced cluster, and tenant separation is enforced at the authorization layer by a Cedar policy engine — deny-by-default, fail-closed, and covered by an automated allow/deny test matrix that runs on every build. Every tenancy, for every client, gets its own database cluster, search index and storage buckets, encrypted under its own customer-managed key; only the network and the compute cluster are shared. Agencies that share one county tenancy are kept apart by the policy engine on every request. Generative AI runs on Amazon Bedrock, in-boundary only. Every record RTIO ingests carries a source reference, so any correlation the platform makes traces back to the exact system it came from. COMMITTED, NOT YET IN PLACE: application-level field encryption for designated sensitive fields, and PII/CJI redaction at ingress before any data reaches a model.
Reference architecture (request via packet)
AI TRAINING
Never on agency data.
What Revelio commits to
- Agency data is never used to train any AI model, and never for any purpose other than serving that agency. The one exception is aggregated, de-identified data that cannot identify any agency, person, incident or location, which Revelio uses only to operate and improve RTIO, and never to train an AI model. Revelio does not train or tune the model behind RTIO, and no model is trained in any deployed environment. RTIO's AI runs on Amazon Bedrock inside AWS GovCloud (US); under Amazon Web Services' terms, the model's developer has no access to agency data.
What changed
- Earlier versions of this page described an opt-in cross-tenant training program, with eligible data classes and a federated-training design. That program has been withdrawn. There is no opt-in: agency data is not used for training under any agreement.
Governance
TODAY: no model is trained on agency data, and no training system runs in any deployed environment. AI features are off by default. COMMITTED, BEFORE AI IS ENABLED FOR ANY AGENCY: every AI output is recorded with the sources it rests on; a reviewer designated by the agency assesses AI outputs after the fact; and if a reviewer finds an output unsafe, Revelio switches the AI off for that agency and opens an incident.
AI PROVENANCE
One card per AI surface. Committed, not yet published.
COMMITTED: every AI surface will ship with a public model card describing the model, intended use, evaluation results, known limitations, and an out-of-scope list. Versioned, and independently reviewed. TODAY: none are published. The surfaces below are the ones that will carry them.
- Surfaces (model card links go here as they publish):
- Incident Summary
- Fire-Behavior Prediction
- ETA Estimation
- Resource Recommendation
- Ask Revelio (conversational interface)
AGENCY DATA, AGENCY LOG
Pull the audit trail on demand.
TODAY: every prompt, completion and citation is logged per tenant with source citations, so any AI-derived statement traces back to a primary record. Each agency can request its own audit records in machine-readable form. COMMITTED, NOT YET IN PLACE: immutable object-lock storage for the audit trail, cryptographic integrity proofs, and a documented agency-facing audit API. These are specified in the procurement packet.
WHO TOUCHES AGENCY DATA
A short, named list.
- Amazon Web Services (GovCloud US) | Compute, storage, database, AI inference | us-gov-west-1 — FedRAMP High
- GitHub | Source control and deployment pipeline; no agency data | US
- Microsoft 365 | Corporate email and document storage; no agency operational data | US
- Zoom | Meetings and recorded sessions with agency personnel | US
- Complete as of the date on this page. Revelio notifies agencies 30 days before adding any sub-processor that processes agency data.
RESILIENCE
MULTI-AZ TODAY. CROSS-REGION DR ON THE ROADMAP.
One region today. Active-passive DR designed, not deployed.
TODAY: multi-AZ database, private cluster endpoint, deletion protection, automated self-healing, and a rehearsed rollback procedure with pre-cutover snapshots — all within us-gov-west-1. COMMITTED BEFORE GO-LIVE: cross-region backup to us-gov-east-1, with a 24-hour restore objective. TARGETED POST-PILOT: active-passive failover between us-gov-west-1 and us-gov-east-1, a quarterly drill program with published reports, and published RTO/RPO targets once measured. No uptime SLA applies during a no-fee design-partner pilot. The agency's existing systems remain authoritative at all times, and RTIO is never in the 911, CAD, or dispatch path.
WHO REVELIO IS
US persons. No interactive production access.
TODAY: all Revelio personnel are US persons. Revelio does not access production interactively — deployments run through continuous integration using short-lived, keyless credentials, and the bootstrap credential is deactivated once that path exists. BEGINS ON SIGNING: fingerprint-based background checks and CJIS security awareness training through GBI's vendor program, completed before anyone reaches agency data. Access to agency data is limited to a small cleared team, only to support that agency, and only with the agency's written authorization. COMMITTED AT THE SECOND ENGINEERING HIRE: privileged-access workstations, and multi-party approval for privileged access logged to the same immutable store as agency audit data.
RESEARCHERS
Coordinated disclosure.
Security researchers should email trust@reveliocorp.com with the issue. Revelio acknowledges within one business day and commits to a status update every seven days until resolution. COMMITTED: a published PGP key for encrypted reports.
Need more?
The procurement packet contains the reference architecture, the CIO/CISO hosting brief, the sub-processor list, the pilot agreement with its security and data-processing exhibits, the mutual NDA and the HIPAA BAA. Items marked targeted or committed above — the CJIS assessment, DR drill reports, penetration test results and model cards — are listed there with their current status, and become available as they are issued.