We can answer it record by record. That answer has cost us deals, because building a database this way is slower and more expensive than the alternative, and we would make the same choice again.
Every record in UMbRA entered through one of these. There is no other path.
Arrest and booking records, held by the agency that made the arrest.
Adjudicated outcomes, carried on the same law enforcement record as the arrest they came from.
Active warrants issued by local judges and held by the agency that owns them.
Registration records from the agencies that maintain the registries, and from the service providers who operate registry systems on their behalf.
Victim-side records, which is the half of this work that gets less attention and matters just as much.
Every one of those comes from law enforcement, or from a service provider running part of a law enforcement function under contract to the agency. Nothing enters from anywhere else.
Records reach us two ways. Some are sources an agency has itself made public: warrants, registries, wanted notices, missing person bulletins. The rest are direct feeds from contributing agencies under a data agreement, syncing continuously so a change at the source propagates rather than sitting stale.
Permanent law-enforcement reference
One image, compared and discarded
No path back. Sensors never write to the gallery.
Stated flatly, because hedged versions of these sentences are how the industry got into trouble.
Warrants come from local judges. That is a deliberate boundary and it is not negotiable in a deployment.
This surprises people, so it is worth stating plainly.
Safience has no ability to alter the substance of a record in the gallery. Not on request, not for a customer, not for the person the record is about.
If someone believes a record about them is wrong, the correction has to come from the originating law enforcement agency. When that agency updates its own records, the change flows through on the next sync.
That is a worse experience for anyone trying to get something fixed quickly. It is the only design under which the phrase “law-enforcement-sourced” continues to mean anything, because a database a vendor can quietly edit is a database sourced from that vendor.
The originating agency. Not us, not the customer, not the subject.
A database a vendor can quietly edit is a database sourced from that vendor.
An operator never gets direct access to the gallery. They see their own sensors, their own lists, and the alerts they are authorized to receive. Nothing else.
Access is governed by role and attribute-based controls, and every query is logged against a named user.
Reach does not mean exposure. An agency contributing records is not thereby exposed to every other participant, and access scope does not widen because a vendor decided it should.
A complete chain of custody exists from ingest through handling to alert dispatch. Who saw what, when, and what they did about it.
That record is the point. An identification system that cannot reconstruct its own decisions is not auditable, and a system that is not auditable will eventually be asked a question it cannot answer.
Who saw what, when, and what they did about it.
Every query is logged against a named user, from ingest through handling to alert dispatch.
If you need this in a form your legal or compliance group can file, or you have a sourcing question this page did not cover, ask.
