Trust

Security

How Rescuezu protects each department's data, what we do not claim, and how to report a security issue.

Last updated October 22, 2026

This page describes how Rescuezu is built and hosted today, without grand claims. If you need more detail for a security review, email security@rescuezu.com.

Report a security issue

If you believe you have found a security vulnerability in Rescuezu, a department site hosted on Rescuezu, or this website, email security@rescuezu.com so we can fix it. We will acknowledge your report within three business days.

Please include:

  • The address or feature affected.
  • Steps to reproduce the issue.
  • What you expected to happen, and what happened instead.

Please do not access, change or delete data that is not yours, and do not run tests that could disrupt a department’s site. We will not pursue action against research done in good faith within these limits.

How we protect department data

  • Hosting. Rescuezu runs on Amazon Web Services in the United States.
  • Encryption in transit. Every site, the admin and the API are served over HTTPS only.
  • Encryption at rest. Uploaded photos and files are encrypted at rest, and two-factor secrets are encrypted in the database.
  • Sign-in. Passwords are hashed with Argon2. Members with administrative roles must use a second factor (an authenticator app or a passkey), including when they sign in with Microsoft.
  • Isolation. Each department’s data is kept separate from every other department’s, and access is checked on the server for every request.
  • Audit. Sensitive actions in the admin are recorded.
  • Least data. We never ask volunteer applicants for a Social Security number, date of birth or medical information.
  • Spam and abuse. Public forms are protected by Cloudflare Turnstile and rate limits.
  • Backups. The database is backed up automatically, and backups are kept for seven days.

See our privacy policy for what we collect, why and how long we keep it. We do not sell your data.

What we do not claim

We are a small team and do not currently hold formal third-party certifications such as SOC 2. We will tell you plainly what is and is not in place when you ask.

Not for emergencies

Rescuezu is not a dispatch, CAD, paging or ePCR system. In an emergency, call 911.