Built to be trusted with your city's records.
Deny-by-default access on every surface. Per-city isolation at the database layer. Signed records you can verify yourself. Your data leaves with you, always.
Written for city IT directors and procurement teams — how the platform is actually built, no marketing gloss. If your city has a security questionnaire, send it over and we'll complete it.
Fail-closed on every surface; access and entitlement suites run before every release
Card fields are hosted by the payment processor — card numbers never touch our servers
Full export on demand, open formats, no export fees
Civic receipts signed and sealed, independently verifiable
Your city owns its data — structurally, not contractually.
Ownership that depends on a clause in a contract isn't ownership. Every record your city creates is exportable, in open formats, through the same API our own applications use.
-
Full export on demand
Every record belongs to your city, in open formats. Your records always leave with you.
-
API-first, headless
The same open API our applications use is available to your city — nothing is trapped behind a proprietary interface.
-
No lock-in by design
No per-record export fees. No "conversion project" to get your own records back.
-
Your database, where you choose
We host and run the platform. Your city's database can live on our managed hosting at cost, or on infrastructure your city controls. The data is yours either way.
One city, one isolated tenant.
Isolation enforced where it can't be bypassed — the database layer, not just application code.
Isolated by schema
- Each city runs in its own isolated database schema.
- Cross-tenant reads are blocked at the database layer, not only in code.
- A bug in one city's module cannot reach another city's records.
Repeatable provisioning
- Provisioning, migrations and upgrades are automated and repeatable.
- The same audited process for every city — no bespoke one-off setups.
- Verified by tests before every release.
Deny by default — on every surface.
Most platforms add permission checks where someone remembered to. Civic Kernel inverts that: nothing is reachable unless a valid, current entitlement explicitly enables it. A missing, expired or malformed permission enables nothing.
Try it — set an entitlement
This contract is fail-closed by construction across all 108 modules — and the access and entitlement suites run before every release.
Role- and scope-based staff access
- A clerk who can process refunds cannot open treasury reconciliation.
- A read-only role cannot fetch what it cannot see.
Turning a module off is reversible
- Disabling a module removes all of its surfaces — without deleting records.
- Re-enabling restores full function with data intact.
Card data never touches our servers.
Card numbers are entered on the payment processor's own hosted fields and never transit or rest on Civic Kernel infrastructure. Everything on our side reconciles against a ledger, not a guess.
Where the card is entered
A certified provider hosts the payment fields. The resident's card details go straight to the certified processor.
- Processor-hosted card surfaces
- The processor carries the card-data obligations
- Cities keep their own payment processor
What we actually store
An obligation and its outcome — never a card number. Duplicate charges are structurally prevented.
- Every charge tied to a durable, idempotent obligation before any provider call
- Refunds reconcile against a ledger, not a guess
- Capture is confirmed by a signed, tenant-scoped webhook — never by an optimistic redirect
Verifiable records — not "trust us".
Selected official milestones mint signed civic receipts that are sealed nightly. Supported city documents can be checked independently against those receipts.
Signed & sealed
- Selected official milestones mint signed civic receipts, sealed nightly.
- Supported city documents can be independently verified — try the verification demo.
- Administrative actions leave an audit trail: who, what, when.
Sealed into the nightly cryptographic root — tamper-evident and independently checkable.
AI that cannot leak what it cannot see.
The copilot is grounded in your city's live records, read-only, and drafts only — a person approves every action. It obeys the same fail-closed entitlements as everything else. And every AI feature is included free — never a paid add-on.
Grounded & read-only
It cites real records and cannot invent one. It drafts content for staff to approve — it never sends.
Same fail-closed rules
If a module is off, the AI cannot ground on its data. Entitlements govern AI exactly as they govern staff.
Free AI, on your city’s own records
Every AI feature is included free — AI is never a paid add-on, and it is never metered per question, per seat or per city. It reads your city's own records, read-only, and drafts for a person to approve.
Boring where it counts, staged where it matters.
A bad release should be caught before your residents ever see it — so every release passes through the same gates.
Hosting & backups
- US-based hosting, TLS on every connection.
- DDoS protection and edge caching in front of the platform.
- Nightly encrypted backups, off-site and independent of the primary host.
- Platform hosted and run by us; your database on our hosting at cost or on infrastructure your city controls.
Every release, same gates
Every resident, day one.
Accessibility and language access aren't a later phase — they ship with the platform.
-
Built to WCAG standards
Tested across devices and viewports — not retrofitted after launch.
-
English & Spanish from day one
Across the public site, notifications and every resident flow.
Complete architectural transparency.
Built to modern security standards and best practices — and open about all of it. Your questionnaire answered in detail, with direct access to the engineers who built the platform.
Ask us the hard questions — that's what the demo is for.
A human engineer reads every message.
Questions, a security review, or a vulnerability to report — write to us directly. If your city has a questionnaire, send it and we'll complete it in detail.