Security and privacy
A CERT incident carries people's names, where they are, and sometimes medical details about the people they're helping. This page covers how that's protected on the radios, on the phones and on our servers, who can see what, and how long it's kept. A few things aren't built yet. Those are marked.
Last updated October 21, 2026
On the radios
Every incident gets its own radio channel with its own 256-bit key. The server makes a fresh random key when an incident is created, so a key from last month's drill is no use at this month's storm. Radios that don't have the key hear noise.
Volunteers get the key when they check in, from the QR code at staging or from your server with a check-in code. Those codes expire after a day unless command sets a longer limit (a week at most), and command can withdraw one at any time. If a radio doesn't have the incident channel set up, the app holds messages rather than sending them on the radio's public default channel.
When the check-in names command's radio, messages go to that radio directly and are also encrypted to that radio's own key, so other radios on the channel pass them along without being able to read them.
When a volunteer checks out and command accepts it, the phone deletes the incident data and clears the incident channel off the radio (or the next time it connects, if the radio is switched off).
Everyone checked in to an incident shares that channel key. If a phone is lost mid-incident, command can cut it off from the server, but changing the key on the radios means starting a new incident for now. A per-incident rekey, and encryption of CertMesh's own messages on top of the radio channel's, are both planned.
Signing in on a phone
Volunteers sign in to an incident with their name and a 4-digit PIN. That works with no signal at all, which is the point, but it also means a 4-digit PIN isn't much protection on its own. So three wrong tries lock the phone for five minutes and tell command, and command checks every check-in against the roster as it arrives. Only command and above ever receive the data used to check PINs.
Phones that talk to the server over the internet don't hold a password. Each one makes its own signing key when it enrolls and signs every request with it, and each signature is good once, for about two minutes. Command can revoke a phone from the console.
Signing in to the console
- Passwords are 12 characters or more, and common ones are refused. We store them hashed with Argon2id.
- Repeated wrong passwords lock the account for a minute, then longer each time, up to 30 minutes.
- Admins and owners have to use two-step sign-in (an authenticator app code, with 10 recovery codes). Anyone else can turn it on.
- Risky actions ask for the second step again if it's been more than 15 minutes: granting admin, approving a deletion, exporting everything, changing EOC credentials.
- Console sessions end after 12 hours idle, and after 7 days no matter what.
Who can see what
| Role | Can |
|---|---|
| Viewer | Looks around the console. Cannot see live positions. |
| Member | Everything a viewer can, plus the live map and position tracks. |
| Command | Runs incidents and the roster, hands out check-in codes, gets the PIN checks. |
| Admin | Manages members, teams, areas and settings, approves deletions, sets up EOC forwarding. Two-step sign-in required. |
| Owner | Billing and full exports. Two-step sign-in required. |
Volunteer locations
Positions are shared only while a volunteer is checked in to an incident, and only with your own team: members, command and admins. Viewers can't see them, and other volunteers' phones can't either. There's no public map.
The exception is a call for help. An SOS goes to your team and to any neighboring agency on CertMesh whose area is within 50 miles of it, with the sender's name and position, because the closest help may be theirs.
Positions are kept for 30 days after the incident closes, then they're up for deletion with everything else below.
Today a position goes to command when a volunteer sends a form or drops a point on the map. Automatic position updates every few minutes, and the SOS button on the phone, are still being built.
On our servers
Each agency's data is walled off from every other agency's in the database itself, not just in the app. Secrets (radio keys, PINs, check-in codes, EOC passwords, authenticator secrets) are encrypted with a key that belongs to your agency, and that key is encrypted with a master key kept outside the database. Everything travels over HTTPS.
The audit log records who did what in the console. The software can add to it but can't change or remove an entry, and it's never deleted.
If your agency has to keep its data in-house, the same server is built to run on your own hardware, down to a Raspberry Pi at the command post. We haven't published an installable release of it yet, so talk to us first.
Records and how long they're kept
Messages and forms are public record, the same as radio logs and paper forms, and the app says so while volunteers write. The clock starts when the incident closes:
| Record | Kept for |
|---|---|
| Positions | 30 days |
| Messages | 3 years |
| Incident records and forms | 5 years |
| Victim treatment (CERT 5) | 10 years |
| Roster entries | 3 years after the member leaves |
Where state law sets a longer minimum (Florida, Texas and Connecticut so far), the longer one wins. Nothing is deleted automatically: an admin approves each deletion, and a legal hold or an open records request blocks it. Victim treatment forms are left out of exports and EOC forwarding unless someone turns them on and gives a reason, which is logged.
An owner can export everything at any time as a ZIP of spreadsheets, map files, PDFs and the original uploads. It's your data.
Questions
If your county's IT or legal team has a security questionnaire, send it to hello@certmesh.org and we'll fill it in.