This document is restricted to authorized personnel only.
Voice-to-Report System · Hebron Police Department · McHenry County, Illinois
DictateIQ is built on a multi-layer security architecture designed to protect sensitive law enforcement data at every point in the workflow — from the moment an officer speaks into their phone to the moment the Chief reviews the final report. This document outlines the specific technical controls, encryption standards, and operational safeguards in place.
All voice calls, transcriptions, API requests, and report deliveries travel over TLS 1.3 — the highest current standard. No data ever moves over plain HTTP.
Every report file is assigned a cryptographically random 256-bit token. The URL is mathematically unguessable — not sequential, not predictable. Only the officer receives it by SMS.
Every incoming call and SMS is verified using Twilio's cryptographic signature. Forged or spoofed requests are rejected with a 403 Forbidden before any data is processed.
The report storage directory has no index. Visitors cannot browse, list, or enumerate stored files. Access requires a valid token URL.
Reports are delivered as forced file downloads, not browser-viewable pages. This prevents cached previews and ensures the file is received intentionally.
All report responses include Cache-Control: no-store. Reports are never cached by browsers, proxies, or CDNs between the server and the recipient.
The report directory only accepts GET requests. POST, PUT, DELETE, and PATCH are blocked at the server level — no external party can modify or overwrite stored reports.
X-Frame-Options: DENY is set on all report responses. Reports cannot be embedded in a third-party iframe or used in frame-injection attacks.
Any attempt to access a report over HTTP is automatically redirected to HTTPS with a 301 permanent redirect before any content is served.
| Layer | What Is Protected | Standard / Method | Status |
|---|---|---|---|
| Voice Transmission | Officer's spoken report over phone | Twilio SRTP + TLS 1.3 | ✅ ACTIVE |
| Transcription | Audio → text via OpenAI Whisper | HTTPS / TLS 1.3 · API key auth | ✅ ACTIVE |
| Field Extraction | GPT-4o processing of transcript | HTTPS / TLS 1.3 · API key auth | ✅ ACTIVE |
| Webhook Integrity | Incoming call / SMS authenticity | HMAC-SHA1 Twilio Signature | ✅ ACTIVE |
| Report File Storage | DOCX stored on web server | 256-bit random token filename | ✅ ACTIVE |
| Report Delivery (SMS) | Download link sent to officer | Twilio SMS / TLS · Officer's device only | ✅ ACTIVE |
| Chief Notification | Alert to Chief's two verified numbers | Twilio SMS · Dual-number verification | ✅ ACTIVE |
| Database Records | Report metadata in Base44 database | Service-role token auth · Encrypted at rest | ✅ ACTIVE |
| Directory Access | Report folder browsability | Options -Indexes · LimitExcept GET | ✅ ACTIVE |
| Browser Cache | Report preview / caching | no-store · Content-Disposition: attachment | ✅ ACTIVE |
HMAC-SHA1 before processing begins.TLS 1.3. No audio file is stored after transcription completes.TLS 1.3. ILCS statutes, UCR codes, and flags are auto-assigned without officer input.256-bit cryptographically random token as its filename. No sequential numbering./reports/ directory. Directory browsing is disabled.Voice recordings are downloaded from Twilio for transcription only. No audio file is retained in the DictateIQ system after processing. Audio is deleted from Twilio storage per their standard 30-day policy.
Report data is not shared with, sold to, or accessible by any third party. GOAL Investment Inc. is the sole operator of the DictateIQ infrastructure.
Only data explicitly provided by the reporting officer is stored. No passive data collection, no tracking, no analytics on report content.
Privacy by DesignReports are delivered exclusively to the phone number that filed the report. No login portal means no credential theft surface. Chief alerts go only to pre-verified, hardcoded department numbers.
Zero-Login ArchitectureDictateIQ is designed with awareness of FBI CJIS Security Policy principles including data encryption in transit, access control, and audit logging. Departments requiring full CJIS certification for criminal history integration should consult their state CJIS Systems Agency. DictateIQ as a report-generation tool — not a criminal history query system — operates outside the scope of mandatory CJIS certification for its core workflow.
No report file can be guessed by incrementing a number. Every filename is a unique 32-character hex string.
TLS 1.3 on all API calls. SRTP on voice. SFTP for file transfer. No plaintext paths.
Twilio HMAC signature validation rejects any request not originating from verified Twilio infrastructure.
Dashboard access is direct-URL only with no public login page. No credential attack surface for the public.
Every report is logged with officer phone, timestamp, case number, statute, and status in the database.
Every report automatically notifies the Chief on two verified numbers. No report goes unreviewed.
GOAL Investment Inc. · DictateIQ Division · goalinvestment.biz
680 N Lake Shore Drive, Suite 110, Chicago, IL 60611 · (815) 893-2358 · support@goalinvestment.biz
Director of Operations: Michael Bruer · D-U-N-S: 03-461-2326 · Illinois C-Corp · Est. 2013
This document is prepared for authorized department review only. Security configurations are subject to change as the system evolves.