Security is built
in.
From day one.

THU APR 233:02 AM

The data we process

We process face scans, voice recordings, transcripts, your location, and your SIA licence details. Below, you can see where each type of data is stored and how we protect it.

Where our intelligence comes from.

Alpha One builds every brief and every alert from sources that are either already public or already ours: police appeals and emergency service communications published to the public, the national threat level, transport and major-incident feeds, open crime and council data, verified reporting, live public signals from across the city, and alerts sent by licensed officers on the network.

We do not listen to private or encrypted radio. We do not use covert sources. We do not track people and we do not buy personal data. Every alert shows where it came from, and anything we cannot attribute does not go out.

What we do with it.

Alpha One reads everything, discards what is not relevant to where an officer is standing, and sends only what matters to them. Nothing is broadcast without a relevance check. Nothing that names a member of the public is broadcast at all. Alerts are kept for a limited time, then deleted. Everything stays in the UK, and none of it is used to train anyone’s models.

Your data stays
in the UK

We work with a number of trusted partners to help operate OnSiren. Some store your data, while others support limited operational functions.

Amazon Web Services

Cloud hosting, AI inference (Bedrock), face-liveness detection (Rekognition), object storage (S3), and text-to-speech (Polly). London region (eu-west-2).

Anthropic

Claude foundation models for the Alpha One dispatcher. Accessed through AWS Bedrock (in eu-west-2) — prompts and completions stay inside AWS infrastructure and are not used to train Anthropic or Amazon models.

Deepgram

Speech-to-text, text-to-speech, and the Alpha One Voice Agent. Routed through Deepgram’s EU endpoint.

PostgreSQL

Primary relational database (Amazon RDS, eu-west-2). TLS in transit, certificate verification on.

Redis

In-memory cache, session store, and BullMQ job-queue backing. eu-west-2.

LiveKit

Self-hosted WebRTC transport for push-to-talk audio. UK or EU infrastructure.

Twilio

SMS one-time-password delivery. Phone number plus the message body (OTP codes today).

Google reCAPTCHA

Abuse and bot mitigation on phone OTP and the public claim flow.

Google Sign-In

Identity provider for the admin console. Staff only; officers never see it.

Slack

Optional operator notifications for the claim funnel. Off by default; phone numbers and emails are partial-masked.

Mailtrap

Transactional email delivery for system messages and OTP fallback. EU-incorporated (Czech Republic).

Google Tag Manager

Tag management container for analytics on this site. The container loads only after you accept analytics cookies — nothing loads if you decline.

Google Analytics

Aggregated visitor analytics (GA4) on the landing site, consent-gated, with Google Signals off and ads personalisation off. Google states that GA4 does not log or store visitor IP addresses. Analytics data is processed by Google in the United States under an approved UK transfer mechanism (see our Cookie Policy).

Cookies

We use cookies to understand how our website is used and improve your experience. These analytics cookies are optional: nothing is set unless you accept. For more information, please see our Cookie Policy.

UK Data Residency: Where Your Data Lives | OnSiren