For your IT department.

Where is the data?

Service data is hosted on Microsoft Azure in US regions. Data is encrypted at rest using Azure storage and database encryption controls and encrypted in transit over HTTPS. Current subprocessors are listed on the Subprocessors page.

Does it need anything installed?

CivicRecordsOnline is browser-based and does not require an on-premises application or hardware. Staff can use a username and password or Microsoft or Google work-account sign-in on every plan.

Who can see what?

Access combines tenant isolation, staff roles, and department scope. Administrators manage agency settings and staff; records clerks work requests across the agency; department users are limited to requests assigned to their department; reviewers check requests before records go out but cannot delete requests, manage staff, or change settings; and viewers are read-only. The application protects request audit entries from direct update or deletion during the normal request lifecycle. Associated audit records are removed when the owning request or agency is permanently deleted.

What about payment card data?

Stripe processes CivicRecordsOnline subscription payments. CivicRecordsOnline does not process requester payments to agencies. Agencies record public-records fees as due, paid, or waived and collect them through their existing process.

How are redactions handled?

Redaction is controlled by authorized staff using browser-based review tools. Auto-PII scans use deterministic pattern matching for structured values such as SSNs, phone numbers, emails, DOB context, addresses, ZIP codes, driver license numbers, VINs, credit cards, IP addresses, plain-English health terms, and ICD-10 code patterns. Staff can also bulk match literal text or regex patterns across a document.

The automation creates draft redactions for review; it does not publish silently. Staff can adjust boxes, add exemption codes and notes, approve or reject drafts, and publish a separate redacted release copy. Redaction never alters the source file; the source file is retained until the agency-configured retention window ends (see the data lifecycle section below). Redaction records are included in the audit trail.

The redaction workflow is not generative AI and does not send agency records to train external AI models.

Can we get our data out?

Agency administrators can create a ZIP export containing request records, request audit history, document metadata, retained source files, and available redacted copies. Source files already cleared under the agency's retention settings are represented by document metadata and the stored SHA-256 value. The current export does not include every application record, such as staff credentials, authentication tokens, support tickets, or all agency configuration.

What is the data lifecycle?

Your agency's own records system remains the system of record for original documents; CivicRecordsOnline holds working copies. After an administrator confirms retention settings, a scheduled job can clear source files a configured number of days after a request closes. The starting value is 180 days and may be raised where the seeded state data includes a longer dispute window; administrators can choose 30 days to 10 years or disable source-file clearing. A SHA-256 value is computed at upload, and cleared files leave document metadata and the stored hash in the request history.

The source-file purge does not remove release copies, request records, or request audit history during an active account. A litigation hold set by the assigned lead clerk or an administrator exempts the request from automatic closing and source-file clearing while the hold remains active. Automatic closing is separately configurable from 7 to 365 days and can be disabled. Account cancellation and a verified deletion request are separate lifecycle events: active-system deletion begins within 30 days of the request, subject to legal retention requirements, while backup copies may remain until their normal expiration.

Can we bring data in from our current system?

Yes — for request history metadata. The bulk importer is a self-serve CSV upload under Settings → Bulk Import. It includes direct format mappings for NextRequest, GovQA, JustFOIA, FOIAXpress, and MyGovHub exports, plus a generic CSV format for everything else. Original dates, statuses, requester contact information, and source IDs are preserved. Per-row error reports and one-click retry are built in for rows that do not import cleanly.

The importer does not move document files. On the City and Metro plans, an optional one-time records import brings them in too: an agency administrator uploads one export, a request list plus one folder of files per request, as ZIP files of up to 10 GB each from a signed-in page in the app. Each file goes from the administrator's browser straight into CivicRecordsOnline's own Azure storage in US data centers, and the files are never sent to an AI service. Without it, your previous system can stay accessible as read-only while CivicRecordsOnline becomes the system of record for new requests, or files can be moved on your own timeline.

How is support handled?

Support is in-app. The staff portal includes a Support page where authorized users can open a ticket with subject, category (General, Issue, Billing, Setup), message, and attachments (10 MB per file, 25 MB per ticket). Tickets are scoped per agency, visible only to authorized staff at that agency, and identified by a per-ticket number (SUP-YYYY-XXXXXX) for reference. Each ticket carries a status history (New / In Progress / Resolved) and a threaded reply log; updates trigger email notifications to the agency.

There is no external helpdesk URL, no third-party ticket system to provision, and no support workflow that depends on email forwarding rules at your end.

Accessibility and ADA Title II

The U.S. Department of Justice's 2024 rule under Title II of the Americans with Disabilities Act requires the web content state and local governments offer the public — including a public records portal — to conform to WCAG 2.1 Level AA. The compliance deadline is April 26, 2027 for governments serving 50,000 or more people, and April 26, 2028 for those under 50,000 and for special districts. See the U.S. Department of Justice's current guidance.

CivicRecordsOnline targets WCAG 2.1 Level AA for its public pages and includes automated accessibility checks in the release process. Automated tests cannot establish complete conformance, and an agency remains responsible for its broader Title II obligations, including the content and documents it publishes. See the accessibility statement and report barriers to accessibility@civicrecordsonline.com.

What about law enforcement records?

You can run these requests through CivicRecordsOnline. Intake, the statutory clock, department routing, fees, correspondence, and the audit trail work the same way for a body-camera request as for any other, and it counts on your compliance report like every other request.

What changes is delivery. CivicRecordsOnline is not offered as a CJIS-compliant environment, and it does not redact video or audio. Face and license-plate blurring and audio muting happen in the tools your department already uses. Footage that has already been redacted, or that needs no redaction, can be uploaded to the request and released from there: up to 100 MB per recording on District, 500 MB on Town, 2 GB on City, and 10 GB on Metro. Staff confirm a recording has been cleared before it goes out.

Material that is Criminal Justice Information under the FBI's CJIS Security Policy stays out of CivicRecordsOnline. Release it on disc or drive, by in-person inspection, or through the system your department already uses for evidence, and you still have one record of the request itself.

That scope choice is deliberate. It is part of how every plan stays under $500 a month. Your agency decides which records and workflows fit the service under its own policies and legal obligations.

What about HIPAA?

The same split applies. A request for records containing protected health information can be logged, tracked, and closed in CivicRecordsOnline, with the records themselves delivered outside it.

CivicRecordsOnline is not designed or contracted for HIPAA-regulated protected health information, and PALDAM does not provide a Business Associate Agreement for this service. If your agency needs the records handled inside a HIPAA-regulated environment, use another system for that material.

One thing to know: requesters write their own descriptions on the public form, so a request can arrive with health details in the text. The Public Request Log, which shows descriptions, is off unless you turn it on.

Confirm scope before purchase

CivicRecordsOnline is focused on local government document and image records workflows. It is not the system for the records that require video redaction, a CJIS-compliant environment, or a HIPAA Business Associate Agreement, and it is not an enterprise-wide government software suite. IT, legal, records, and purchasing staff should confirm those requirements before the agency subscribes.