04 / 05
There is no shared login page. Every agency gets its own subdomain, and an account that belongs to one is refused at every other.
There is no public download. An officer signs in at the agency's address, and the build for Windows or macOS is served to that session against the agency's licence. A licence that has lapsed serves nothing, and says so.
The credentials the administrator issued work at the address and in the application, and nowhere else. An account belongs to one agency, so a correct password presented at another is refused. Identity, role and unit arrive with it, together.
Every privileged action is written to a log in which each entry carries the digest of the one before it. Edit or delete a line and every hash after it breaks, and the check names the sequence number where it broke.
The same chain is mirrored off the workstation, append-only, under a retention policy. Wiping a machine removes a copy. Deleting an entry to tidy up is the one thing the log exists to prevent.
The application checks for a new version itself, downloads it, verifies its signature against a key compiled into the binary, and holds it. Nothing installs until the operator presses Restart now. A build that fails the check is not an update; it is discarded.
Your organisation is created with its seats, its entitlements and one administrator. It is given its own address at the same moment, and that address is the only door into it.
maplecounty.ocsbe.com
Signing in at that address, your administrator downloads the desktop application and creates each officer's account: address, role, unit, all in one action. The account arrives already belonging somewhere.
Identity, role and unit issued together
You send them the address. They sign in with the credentials your administrator handed them, take the build for their platform, and the same credentials work in the application.
Windows and macOS, behind the same sign-in