Regulatory alignment

This chapter describes how the IREX platform supports an operating organization's own compliance program. It covers the FBI CJIS Security Policy, the EU General Data Protection Regulation (GDPR), and the EU Artificial Intelligence Act. It also covers the NIST AI Risk Management Framework and US state privacy and biometric law.

Where responsibility sits

Almost every requirement below splits into a part the platform can enforce and a part only the operating organization can decide. Keeping that line clear is the difference between a compliance position that survives an audit and one that does not.

The platform provides	The operating organization decides
The technical controls: access control, encryption, logging, retention enforcement, export.	The lawful basis for processing, and the legal authority each action rests on.
The mandatory Case ID gate on privacy-sensitive actions.	What counts as a valid Case ID, and who may open one.
Configurable retention, with physical erasure when the period expires.	The retention period itself, and any legal hold that overrides it.
Watchlist-only recognition, with a platform-enforced database size limit.	Who is enrolled on a watchlist, and on what grounds.
The audit record, and its daily signed export.	Who reviews it, how often, and what follows from a finding.

For deployments managed by IrexAI, IrexAI typically acts as processor and the customer as controller. For customer-hosted deployments, the customer is both controller and operator. The split is recorded in the customer agreement and the data processing agreement.

FBI CJIS Security Policy

What CJIS is

Criminal Justice Information Services (CJIS) is the largest division of the FBI. It includes the National Crime Information Center, the Integrated Automated Fingerprint Identification System (IAFIS), and the National Instant Criminal Background Check System. Its databases are the centralized source of criminal justice information for agencies across the United States.

The CJIS Security Policy sets security standards for every organization, cloud vendor, local agency, and corporate network that handles criminal justice information (CJI). The standards cover wireless networking, remote access, data encryption, and multi-factor authentication. The consequences of non-compliance are practical rather than nominal: an organization found in breach can lose access to CJIS data. The policy is published by the FBI CJIS Division, and its requirements are organized into 13 policy areas.

The 13 policy areas

Policy area	What CJIS requires	What the platform provides
Information exchange agreements	A formal agreement with any agency before CJI is shared with it.	Nothing to provide. The platform holds no CJI, so the agreement is between the customer and the other agency.
Security awareness training	Training within six months of assignment, repeated annually.	Security training for customer staff within the first six months and annually thereafter, plus an online security guide and training videos.
Incident response	An incident response plan covering identification, containment, eradication, and recovery, with breaches reported to the Justice Department.	A template incident response plan for the customer to adapt.
Auditing and accountability	Monitoring of all access to CJI, including who accessed it, when, and why, with a historical archive for forensic analysis.	Authentication of every user and a record of every action: sign-in, face search, video export, permission change. Every privacy-sensitive action carries a Case ID stating why it was taken. Logs are exported unaltered to a secure archive so they survive a disaster or a breach.
Access control	Role-based access control with roles reflecting job type, location, IP address, and time.	Hierarchical role-based access control down to the individual camera, recording, media item, and analytics module. See Manage users and user groups.
Identification and authentication	Multi-factor authentication, a maximum of five failed login attempts per user, and periodic password resets.	A set of multi-factor authentication options, including face recognition as an MFA factor.
Configuration management	Configuration changes restricted to authorized users, documented, and protected from unauthorized access.	Configuration changes available only to top-level roles, with every such action logged in full detail.
Media protection	Policies for protecting and securely disposing of all forms of media.	Deployment in trusted data centers, including a choice of location by county or state, or on-premises in the customer's own facility. See Data and technology sovereignty.
Physical protection	Limited and monitored access to physical media and facilities.	The platform can be used to protect its own server rooms and network equipment, detecting intrusion, access rule violations, and fire safety violations.
Systems and communications protection and information integrity	Perimeter security, encryption of CJI at rest and in transit, and protection against unauthorized access.	A multilayer web application firewall, intrusion detection and prevention systems, and a network filter. HTTPS with TLS 1.3 encrypts traffic from edge devices through the private cloud to clients. Outside private networks, VPN or edge servers encrypt RTSP streams from standard IP cameras. Real-time alerts travel through the secure messenger hosted in the private cloud. JSON Web Tokens with asymmetric signatures protect every microservice, client, and third-party integration, with randomly generated keys rotated regularly, so neither a developer nor an installer can reuse an API key to bypass authentication. Third-party security products may be used alongside these controls.
Formal audits	Security audits at least once every three years by the CJIS Audit Unit or the CJIS Systems Agency.	Information relevant to an audit on request, including system log analysis and an account of data handling on IREX-controlled infrastructure.
Personnel security	Screening of employees, contractors, and vendors with CJI access, including fingerprint checks against IAFIS.	Fingerprint checking is implemented by the customer with third-party products. The platform supports face recognition as part of MFA.
Mobile devices	An acceptable use policy covering any laptop, smartphone, or tablet with CJI access.	Progressive web app delivery, so the platform inherits the security features of a modern browser rather than requiring a separately maintained native app. IREX also provides a draft mobile device security policy for the customer to adapt.

GDPR

GDPR is Regulation (EU) 2016/679 (full text), in force since May 25, 2018. It sets out seven key principles in Article 5(1) and 5(2). The platform supports all seven.

Principle	How the platform supports it
Lawfulness, fairness, and transparency	Lawfulness: the platform neither owns nor accesses personal data; it belongs to the customer. Use of the analytics against the law is constrained at the architectural level, because the neural networks are trained to recognize only scenes and subjects that threaten public safety. Fairness: ethics are engineered into the system constraints and safeguards that govern what data is created, and how and by whom it is accessed, stored, and shared. Features, person databases, match alerts, and search results are visible only to users with sufficient permissions. Transparency: the platform records a detailed, searchable, auditable log of database additions and photo searches. See Case ID and accountability.
Purpose limitation	The purposes for processing video data are defined, documented, and stated in the privacy information provided to individuals and organizations. The platform identifies only pre-registered persons, such as missing people, suspects, and wanted persons, and pre-registered vehicles, such as stolen vehicles or vehicles without permission to drive. The number of persons enrollable for real-time biometric identification is limited. There is no recognition or tracking of random people.
Data minimization	IREX works with customers to size their systems to purpose, across camera count, database size, and hardware. The person and vehicle databases are not a general store: they hold only what is relevant to lawful, ethical tracking on public safety grounds.
Accuracy	Accuracy and error probability of the analytics modules are examined continuously and the results published. Where systematic bias appears unavoidable, notably in face recognition, IREX policy is to keep the customer aware of it and of its estimated size, to balance training datasets, and to tune training algorithms. See Engineered for ethics.
Storage limitation	A user-defined retention period is set per camera. When it expires, the data is physically erased from the storage media.
Integrity and confidentiality	A multilayer web application firewall, intrusion detection and prevention, and a network filter, with penetration testing for every major release following the OWASP Testing Guide and other recognized frameworks. TLS 1.3 encrypts traffic end to end; VPN or edge servers encrypt RTSP streams outside private networks; JSON Web Tokens with asymmetric signatures and rotated keys protect the API.
Accountability	The platform authenticates every user and records every action, with the Case ID stating the lawful grounds. Signed logs are exported daily to a secure archive, so the evidence of compliance survives independently of the platform and can be reviewed by an oversight body without platform access.

Data subject rights and retention

• Rights. Access, rectification, erasure, portability, and objection are implemented in the data protection policy. A request received by IREX is routed to the customer as controller, which IREX assists, within the statutory timeframe. Erasure can be limited by an exception such as a legal hold or an open case under investigation.
• Retention. Retention is configurable per deployment and set by the controller. Disposal uses cryptographic erasure or secure overwrite, with verification for the most sensitive classes of data.
• Special-category data. Facial biometric identifiers are special-category data under GDPR Article 9. They are classified as restricted, access is limited to essential personnel under role-based access control, and every access is logged.
• Lawful basis for biometric processing. The Case ID gate operationally enforces it: a court order or equivalent lawful authorization is entered before a face recognition search runs.
• Cross-border transfer. EU and EEA data subjects are served from a local in-region instance. Transfers from IrexAI-managed instances rely on standard contractual clauses with supplementary measures.

EU Artificial Intelligence Act

The EU AI Act classifies real-time biometric identification in public spaces as high-risk and imposes strict obligations on law-enforcement AI. The platform's architecture addresses the core obligations directly:

Obligation	How the platform addresses it
Risk management	Narrow constraints limiting recognition to pre-registered subjects, and a mandatory Case ID on every privacy-sensitive action.
Data governance	Customer-owned data, defined retention periods, and data minimization by design.
Human oversight	A permission-driven interface under role-based access control, with supervisory audit of the Logbook. No consequential decision is taken by an AI agent alone.
Transparency	Non-erasable audit logs with daily signed exports reviewable by independent bodies.
Accuracy	Continuous bias testing and participation in the NIST Face Recognition Vendor Test (FRVT).

NIST AI Risk Management Framework

The IREX ethical AI framework aligns with the four core functions of the NIST AI Risk Management Framework: Govern, Map, Measure, and Manage. For a US agency, this gives a structured and evidence-based route to responsible AI deployment, with the Logbook and its export supplying the evidence.

US state privacy and biometric law

• CCPA and CPRA. Consumer rights to know, delete, correct, and opt out are honored, and biometric information is treated as sensitive personal information.
• State biometric privacy laws. IrexAI commits to meeting the applicable state privacy and biometric-privacy laws in each deployment jurisdiction, including consent rules of the kind found in Illinois. Where two regimes overlap, the more protective standard applies.

What to bring to an audit

These are the platform outputs an auditor or oversight body normally asks for:

• The Logbook, filtered by Case ID, user, event type, or date range.
• The signed daily log exports for the period under review.
• The role and permission structure, showing who could see and do what at the relevant time.
• The retention configuration per camera.
• The person and vehicle database contents and enrollment history.
• Analytics usage statistics from Apache Superset, which can flag irregular usage patterns.

Related topics

• Case ID and accountability: the justification gate and its audit chain.
• Engineered for ethics: the six pillars and their mechanisms.
• Data and technology sovereignty: ownership, deployment location, and retention control.
• View the Logbook: reading the audit record.