The Vendor Audit: Rekor Published a Privacy Framework Three Weeks Ago. We Graded It Against Its Own Terms. It Got a 41.

The lowest score this series has awarded in any area, to any vendor. The Privacy and Terms page defines Operational Data as "The data, images, and video produced from using the Software," then states: "Except as may be stated to the contrary in the Rekor Privacy Policy, you retain ownership in your Operational Data, and we do not claim any ownership rights in your Operational Data." The sentence immediately following reads: "You hereby grant to Rekor and its affiliates a non-exclusive, perpetual, sublicensable, transferable right and license to use the Operational Data for all commercial purposes, and Rekor may disclose the Operational Data to third parties." Take those words individually. Perpetual: the licence does not end when the contract does. Sublicensable and transferable, extended to affiliates: it may reach parties the customer never contracted with. All commercial purposes: not limited to providing the service. May disclose to third parties: no stated standard, no notification requirement, no enumeration of who. Note also that the ownership sentence opens with its own escape hatch — the retained ownership holds "except as may be stated to the contrary" in a separate document. Now compare the same question at the other four. Axon: "Axon will not use Customer Content for any advertising or other commercial purposes," and government demands trigger notice to the customer plus assistance with a motion to quash. Genetec: "We do not sell or rent any personal data to any third party." Even Flock, which scored 42 here and drew criticism for it, limits itself to a "good faith belief" standard rather than an unrestricted commercial licence. The de-identified category goes further still: Rekor "owns all right, title and interests in the De-Identified Operational Data," and "may use the De-Identified Operational Data for all purposes" — all purposes, not merely commercial ones — "and Rekor may disclose the De-Identified Operational Data to third parties." Ownership of the plate reads stays nominally with the agency. Everything that can be done with them does not.

Rekor deserves genuine credit for publishing a privacy framework at all — no other vendor in this series has done it, and the document identifies the right problems: retention, auditability, sharing, and evidentiary integrity are precisely the four areas these cards keep finding trouble in. The company also holds a patent, announced this year, for "encoding and anonymizing vehicle identification data (including license plate reads) at the point of collection." That is real engineering aimed at a real risk. The deduction is for grammatical mood. Every commitment in the framework is a recommendation about what systems in general ought to do — protect non-relevant data "by default," retention that "should be purpose-based, policy-driven, auditable," logs that show "who accessed data, when, and for what purpose." None of it appears as an obligation in the Privacy and Terms page that governs an actual Rekor customer, which was last updated 02/10/2025 and contains no auditability commitment, no default-protection commitment, and no retention standard. A policy paper addressed to legislators is a legitimate thing to publish. It is not a contract term, and a reader who takes the July press release as a description of what Rekor's product guarantees has been given the wrong impression by a document that never technically said so.

One clause decides this area, and it runs the opposite direction from every competitor. Rekor's terms state: "By using law enforcement products in the Services, you agree to share your Data with other law enforcement agencies, unless you affirmatively opt-out." Sharing is the default. An agency that never reads the clause is sharing. And the exit is not a setting: "To opt-out, you must submit a written notice to us at [email protected] requesting that your Data be removed from the data sharing pool of services." Leaving the pool requires composing an email to the vendor — a higher bar than any competitor imposes on joining one. Set that against the architecture the other cards documented. Flock's Trust pages say sharing is opt-in and "nothing is shared unless the agency turns it on" — the company lost points on that card for how it described the network, not for the default itself. Genetec says the customer decides "whether to share plate reads or hits beyond your organizational boundaries." Motorola requires that a law-enforcement customer "has reviewed and agreed to the share" before data moves. Rekor inverts the burden, and it does so in the one product category where the consequence is that one department's cameras become several departments' database without anyone at the originating agency making a decision. The framework published three weeks ago names "problematic interagency data sharing" as a risk the industry must address. The terms make interagency sharing the setting a customer has to find and switch off.

The product side is adequate and matches the sector: Rekor Scout lets customers "define how long vehicle information and license plate images will be retained based on their own privacy and data retention policies," with severity-based auto-retention available per capture type — which is, if anything, more granular than competitors offer. The company-side disclosure is where this thins out. The only retention sentence in the binding policy covers the wrong data: "We will only retain Personal Information about you for as long as necessary to fulfill the purposes Personal Information was collected for, including the purposes of satisfying any legal, accounting or reporting requirements." That governs the personal information of the customer contact — the person who filled in a form — not the plate reads of the public. No document read for this card states how long Rekor itself holds Operational Data, and the perpetual licence in area 1 means the question is not academic: a licence that survives the contract implies retention that survives it too, and nothing published says for how long. As the [retention explainer](/articles/alpr-retention-clocks-explainer.html) for this series set out, the number a council thinks it is asking about is one of four clocks. Rekor answers the customer-facing clock and leaves the vendor-side clock unwritten.

The Security and Trust page states that SHA-256 cryptographic hashing is used to "anonymize license plate data," and the company's patent covers encoding and anonymizing plate reads at the point of collection. Hashing is a real control and better than storing plaintext. But a cryptographic hash only anonymizes when the input space is too large to search, and a licence plate is close to the smallest input space in common use — a US plate is roughly seven alphanumeric characters, which is an exhaustively enumerable universe on ordinary hardware. Unless the hash is combined with a secret salt, computing the hash of every possible plate and matching them back is a routine exercise, and none of Rekor's published documents state whether a salt is used or how it is protected. That is a question the company could close in one sentence. The second half of this area is the part that compounds it: "Rekor owns all right, title and interests in the De-Identified Operational Data." De-identification is not only a privacy control here — it is also the step at which data ceases to be the customer's and becomes the vendor's outright. Both facts are disclosed, neither is hidden, and this card does not assert that the design was chosen for that reason. It notes that the privacy mechanism and the ownership transfer are the same mechanism.

This area exists only because Rekor is publicly traded, and it is the reason this entry was worth doing. The Form 10-K for fiscal 2025 reports a net loss of $31,460,000, working capital of $1,640,000, cash and equivalents of $16,566,000, and an accumulated deficit of $291,553,000. It then states, in management's own words, that "the existing cash is insufficient to fund its current level of operations for the next twelve months following the issuance of these consolidated financial statements. These factors raise substantial doubt regarding the Company's ability to continue as a going concern." The independent auditor's report repeats the conclusion. To be scrupulous: this is a funding-runway judgment, not a forecast of failure, and companies operate under it for years. The score here is not a comment on the business. It is a comment on disclosure, and the finding is that no Rekor document connects these two facts. The privacy terms grant a perpetual, sublicensable, transferable licence and hand outright ownership of de-identified data to the company. The financial statements disclose substantial doubt about that company continuing. Nothing published says what happens to either the licence or the de-identified archive in a sale, a wind-down, or a transfer of assets — and "transferable" is the operative word in the clause. An agency signing today is told its data is its own. Whose it becomes, and under what terms, is the one question the paperwork does not reach. Credit is due for the disclosure itself: it is complete, prominent, and audited, which is more than the private vendors in this series are required to offer about anything.

Middle of the field, and better than it looks at first glance. The Privacy and Terms page carries a clear "Updated 02/10/2025" — roughly eighteen months old at the time of this audit, which is materially fresher than Genetec's 2019 vintage and materially staler than Axon's July 6, 2026 notice. Rekor also gets credit for something the other four do not offer at all: because it files with the SEC, its business description is restated annually under audit, so a reader can check the marketing against a document with legal consequences for inaccuracy. The 10-K's own summary of the company's advantages claims "Industry-leading Privacy and Security: Advanced security technologies, SOC II compliance across all platforms, and proprietary algorithms to protect PII." That is a marketing sentence inside a securities filing, and "industry-leading" is not a measurable claim — but the underlying certification is real and substantiated on the security page, which is more than can be said for the badge that cost Flock points. The deduction is for the gap the whole card turns on: a privacy framework published in July 2026 sits on top of terms last revised in February 2025, and the framework's principles have not been written down into the document that binds.

The strongest area on the card by a wide margin, and second in this series only to Axon. Rekor's Security and Trust page names SOC 2 for its software platforms and links the publicly distributable SOC 3 report — the same reader-friendly choice Genetec made and the opposite of Motorola's SOC 2 held behind a non-disclosure agreement. Alongside it: NIST 800-53, ISO 27001, CJIS compliance scoped to the public-safety solutions, and NDAA and TAA compliance scoped to the video-based camera systems. The technical controls are specific rather than adjectival — "Data is protected in transit and at rest using AES-256 encryption," SHA-256 hashing, "multi-layered identity verification and strict access protocols," continuous monitoring, and the claim that "every device undergoes rigorous third-party penetration testing." Naming the scope of each certification rather than implying blanket coverage is the mark of a document written by someone who expected to be checked. Two deductions. The audit-logging commitment is thin where it matters most — "continuous monitoring through AWS tools" describes infrastructure monitoring, not a per-query record of which officer searched which plate and why, which is the log the other four cards examined and which the company's own July framework says systems should maintain. And the certifications are not dated on the page, so a reader cannot tell how current any of them are.