How CERT Command is built

One record, signed by whoever wrote it

The phone app, the team leader's dashboard and the county's console all work on one shared record of what happened: every check-in, status, report, task and message. Each device signs what it adds with its own key, and the county server keeps the record. A device works without the network, keeps what it does, and sends it with the time it happened once the connection returns.

The apps

• Flutter and Dart (Google) BSD license: one code base for the iPhone and Android app, the Mac and Windows dashboard and the web console, so all of them behave the same.
• Phone app: Mobile Scanner reads the team's QR code (with Google ML Kit on Android), Geolocator shares the position while checked in, Flutter Secure Storage keeps the phone's keys in the iPhone Keychain or Android Keystore, Flutter Local Notifications and Image Picker do what their names say. MIT and BSD licenses
• Dashboard: flutter_map draws the maps, qr_flutter the enrollment codes, the pdf and printing packages the ICS 213 and 214 forms; file_selector, archive and xml open and save files, including the roster's Excel template. BSD, MIT and Apache 2.0 licenses
• Console: the same Flutter code, running in the browser; it makes the county's ICS 213, 214 and 309 forms with the same pdf package.
• Riverpod keeps each screen in step with the record. MIT license

Security

• Signatures: Ed25519, through the cryptography package for Dart Apache 2.0, and libsodium on the server for speed ISC license. Each device's key is certified by its team's key, so a phone joined to one team can never act for another.
• On the phone: what waits for signal is encrypted with AES-256-GCM, with a key kept in the Keychain or Keystore. Nothing about the team stays on the phone after check-out.
• On the leader’s computer: the enrollment is kept in the macOS Keychain or Windows’ credential store; the computer’s copy of the team record, the actions waiting to be sent and the photos are encrypted with ChaCha20-Poly1305, with a key kept there too.
• On the server: each team's key is sealed with AES-256-GCM; PointyCastle MIT license checks the console's passkeys and signs Apple push requests.
• Console sign-in: passkeys (the WebAuthn standard): Touch ID, Face ID, Windows Hello or a security key, never a password.
• Time: hybrid logical clocks, so actions made offline on different devices still line up in the right order.
• In transit: HTTPS everywhere, with certificates from Let's Encrypt.

The county server

• The team server, written in Dart for CERT Command: it checks every signature, keeps each team's record and passes it to the team's devices.
• PostgreSQL 17 PostgreSQL license: the database, copied every night.
• Caddy Apache 2.0: the web server in front, with automatic HTTPS.
• Docker, on a DigitalOcean server in the United States. The code is built to move to Amazon Web Services when the county needs more capacity.

Maps and addresses

• OpenStreetMap: the streets on every map. Map data © OpenStreetMap contributors, available under the Open Database License; every map in the apps shows that credit.
• Nominatim, OpenStreetMap's search service: the nearest street address of a report or a member, looked up by the county server (never by the phones), following its usage policy.

Notifications and email

• Apple Push Notification service for iPhones, and Firebase Cloud Messaging for Android phones. They carry a short notice, such as a new task’s title; everything else comes from the county server when the app opens.
• Brevo: our mailing list and the invitation emails to new team leaders.

Building and distributing

• GitHub keeps the source code; GitHub Actions builds the Windows dashboard and Inno Setup makes its installer.
• The Mac dashboard is signed and notarized by Apple. The Windows dashboard is in the Microsoft Store, signed by Microsoft. The iPhone app is tested through TestFlight, and the Android app through a Google Play test.

Licenses

Every open-source piece keeps its own license, and the apps include their notices with the full text: in the phone app and the dashboard, About › Open-source licenses; in the console, the ⓘ button next to Sign out.

Something missing or wrong on this page? Tell us at privacy@certcommand.org.