POLICY
Data Sovereignty Policy
This policy governs how Cefa Tribal Affairs collects, stores, uses, and returns data submitted by or about Tribal communities. It is distinct from our general Privacy Policy, which covers individual users.
What Data We Collect
- Missing person case submissions and updates
- Tip submissions (encrypted, not read by platform staff without consent)
- Tribal Resource Directory listings submitted by agencies
- Native business profiles and procurement documents
- User account data (name, role, contact, verification documents)
- Platform usage data (anonymized, no individual tracking sold)
How We Protect It
- All data encrypted in transit (TLS 1.3) and at rest (AES-256)
- Tip submissions end-to-end encrypted before platform staff access
- Role-based access controls — law enforcement cannot see family contact data
- All law enforcement access to case records is logged and auditable
- No data stored outside the United States
- Annual third-party security audit
Tribal Nation Rights Over Their Data
Any Federally Recognized Tribal Nation may at any time:
- →Request a full export of all data associated with their Nation or members
- →Request deletion of all records (completed within 30 days)
- →Restrict access to their community's data to specific user roles
- →Enter a Tribal Data Processing Agreement that supersedes standard terms
- →Audit the log of all law enforcement access to their Nation's case records
What We Will Never Do
- ✗Sell, license, or monetize Tribal data
- ✗Share Tribal community data with advertisers, data brokers, or AI training datasets
- ✗Claim ownership of data submitted by Tribal governments or Tribal members
- ✗Use missing person case data for any purpose other than the stated safety mission
Questions or Requests
Contact sovereignty@cefatribalaffairs.org for data requests, Tribal Data Processing Agreements, or audit inquiries.