General operational and educational information for corrections professionals. Not legal, medical, or compliance advice, and not a certification of compliance with any law or standard. Policies and standards vary by agency and jurisdiction; follow your facility's policy and your own legal, medical, and professional advisors. The library is reviewed and updated monthly; see the changelog.
This page answers the first questions county IT, county attorneys, state reviewers and risk managers ask about Virtual Patrol Technologies. It states what is true today, what VPT does not claim, and which documents are available for a formal review.
VPT works with the facility's existing, authorized cameras.
The facility connects to VPT over an outbound-only connection. No inbound ports are opened on the facility network.
Processing runs on Google Cloud in the United States, in an isolated tenant.
Every alert is reviewed by a trained person. Facility staff decide what happens next.
VPT is hosted on Google Cloud in the United States, in an isolated tenant.
Cloud infrastructure authorized up to FedRAMP High (Google Cloud). That authorization belongs to Google Cloud's infrastructure. It is not a VPT certification, and VPT does not claim FedRAMP authorization for its own service.
Data is encrypted in transit (TLS) and at rest (AES-256).
Access uses role-based access control and multi-factor authentication. People see only what their role allows.
VPT keeps audit logs of access to the system. Your reviewer can ask how logs are handled as part of a formal review.
VPT uses third-party penetration testing.
Retention is set by agreement with each agency. It is not a VPT default. The agency decides how long records are kept, and the agreement records that decision.
VPT is designed so that Criminal Justice Information (CJI) is not ingested, stored or transmitted by the VPT system.
CJIS determinations are made by your state CJIS Systems Agency and your local agency, not by a vendor. VPT does not describe itself as CJIS certified, and no vendor can hold a general CJIS certification.
Two documents support that review. A CJIS Exemption Acknowledgment records the agency's isolation of the VPT system from CJI. Where an agency determines that CJI access exists, a CJIS Security Addendum applies to that engagement.
More detail: CJIS and security posture and CJIS-aware deployment considerations.
Possible medical distress is one of the event categories VPT can flag. A trained person reviews each one. VPT does not diagnose and does not make medical decisions.
Timestamped event records support authorized review and coordination between custody and health personnel, consistent with facility procedures and access permissions.
A data privacy and health information addendum is available for agencies that want those terms in writing.
Every alert is reviewed by a trained person. VPT does not make custody, disciplinary or medical decisions. Those stay with facility staff. See human in the loop.
VPT is security-tier adaptive. It deploys at the security level each agency requires, from a county jail with no formal standard up to environments that require SOC 2 or FedRAMP High controls. The required level, and how it is evidenced, is scoped and agreed in each engagement.
VPT does not hold a FedRAMP authorization. The FedRAMP High authorization referenced above is Google Cloud's.
VPT is not CJIS certified. CJIS scope is decided by the agency and its state CJIS Systems Agency.
VPT does not claim HIPAA certification.
VPT publishes no accuracy figures for its alerts. A trained person reviews each one.
For the full list of limits, see what VPT does not do.
Architecture and data flow overview for your security reviewer.
CJIS Exemption Acknowledgment and CJIS Security Addendum templates.
Data privacy and health information addendum.
Responsible Safety Intelligence Policy.
Support for a state alternative controls review, where one is required.
To request these, contact VPT. Documents are shared with your reviewer under a nondisclosure agreement.
On Google Cloud in the United States, in an isolated tenant.
No. The connection from the facility is outbound-only. No inbound ports are opened on the facility network.
Yes. Data is encrypted in transit (TLS) and at rest (AES-256).
No. VPT runs on Google Cloud infrastructure that is authorized up to FedRAMP High. That is Google Cloud's authorization, not a VPT certification.
Yes. VPT deploys at the security level each agency requires, including environments that require SOC 2 or FedRAMP High controls. The level and how it is evidenced are agreed in each engagement.
No vendor holds a general CJIS certification. VPT is designed so that CJI is not ingested, stored or transmitted, and CJIS scope is decided by the agency and its state CJIS Systems Agency.
Retention is set by agreement with each agency. It is not a VPT default.
Every alert is reviewed by a trained person. VPT does not make custody, disciplinary or medical decisions.
