Security that earns the trust behind every listing.
ArmorList safeguards the marketplace data buyers, agencies, and suppliers depend on, and the accounts and communications behind it, with security engineered into every layer of the platform.
Security in every layer.
Data encrypted in transit (TLS 1.2+), and encrypted at rest (AES-256) by our hosting provider, which manages the keys.
Each person gets only the permissions chosen when they are invited: no shared logins and no blanket admin role. Multi-factor authentication (MFA) with an authenticator app is being enabled.
What needs an account is withheld by the server until you sign in. It is not hidden on the page, so it cannot be read from its source.
Each organization’s private workspace, leads, and RFI content are isolated; private data never crosses accounts.
What a buyer searches, saves, and shortlists stays private; suppliers see leads and aggregate engagement, never unsent activity.
Backups are taken by our managed database host, so records stay durable.
Mapped to the frameworks buyers require.
Our controls are designed against the standards enterprise and public-safety procurement expect. For the full framework-by-framework posture, data verification, privacy, export control, and accessibility, see the Trust & Compliance Center.
Controls being built and mapped to the Trust Services Criteria (security, availability, confidentiality) ahead of an independent audit.
Control families mapped as the basis of our security program and a clear authorization path.
Each company record shows which official sources confirmed it, and when. Some sources are still being connected; the Trust Center says which.
Hosted on AWS (US region, us-east-2) with Supabase Postgres, providers that hold their own SOC 2 reports, and served worldwide through Cloudflare. Encrypted in transit, and at rest by the hosting provider.
Note: certifications requiring third-party attestation are marked In progress or Roadmap in the Trust Center and never represented as complete. ArmorList is a public marketplace and does not process criminal-justice information; agency custody data lives in ArmorTrack.
Public where it should be, private where it must be.
ArmorList's visibility model is a security control, not just a feature. Verified directory data is public by design so buyers can trust it, the content of a negotiation stays between the two parties, and a buyer's private research is never exposed to suppliers.
Public listings, company profiles, and NIJ / CPL status, with provenance. Visible to all users.
The content of a request or negotiation is visible only to the buyer and supplier involved.
Searches, shortlists, and unsent activity stay private to the buyer. Never exposed to suppliers.
Built to be checked, by both sides.
What each side gets, what it costs, where the data comes from and how your account is protected, on one page you can print for the procurement file.
- Free for verified agencies and public-safety buyers
- Tested-to standards on the record, with NIJ listings re-checked nightly
- Compare models and request information from suppliers
- Your agency’s data isolated from every other account
- A public profile for every product, whatever standard it is tested to
- NIJ CPL listings linked to your models automatically
- Requests from verified buyers, routed to your team
- Payments by Stripe: card details never reach us
Frequently asked
Where is our data stored, and who can see it?
Data is stored in the United States on AWS (us-east-2) in a Supabase-managed Postgres database, run by providers that hold their own SOC 2 reports, and encrypted in transit and, by the hosting provider, at rest. It is isolated per account. Within your organization, each person holds only the permissions chosen when they were invited; across the marketplace, the visibility model keeps RFI content between transacting parties and keeps a buyer's private research to themselves.
How do I know the data on a listing is accurate?
Key fields are corroborated against authoritative registries, and every verified field carries its source and confidence. The Trust & Compliance Center documents the full methodology, and anyone can flag a field for re-verification.
Can we get a SOC 2 report or security review?
IntelAlytic does not hold a SOC 2 report of its own yet. It is on our roadmap, and we will never represent it as finished before an auditor has issued it. In the meantime, reach out and we will share our current security documentation, control descriptions, and architecture under NDA as part of your procurement review.
Questions from your security team?
We will walk your IT and compliance staff through our controls and documentation.