Choosing Evidence Intake Software: 10 Questions to Ask Every Vendor

Most agencies do not realize they are shopping for an evidence intake layer until they have already lost a case to a discovery challenge. By that point the question is not whether to buy a system — it is which vendor can be trusted with the chain of custody. This is the checklist for that second conversation.

We built Intelintake specifically as the intake layer for digital evidence — the surface that captures, hashes, verifies, and routes every file, link, photo, video, and tip the moment it touches your agency. The questions below are the bar we hold ourselves to. They are also the bar you should hold any vendor to, including us.

Intake layer or records management?

Before the checklist, the category matters. A Records Management System (RMS) is the long-term home for cases — where reports are filed, charges are tracked, and dispositions are recorded. An evidence intake layer is what sits in front of the RMS to capture and verify digital evidence at the moment of collection. They are not substitutes.

The RMS is your filing cabinet. The intake layer is your evidence-handling room. Most agencies have a good filing cabinet. Far fewer have a handling room that meets the bar described below. Intelintake is the intake layer; it feeds whatever RMS your agency already runs, with the full hash chain and audit log intact at handoff.

The ten questions

Print this list. Take it into every vendor demo. If a salesperson cannot walk through all ten in thirty minutes with a live system on the screen, the answer to most of them is no — regardless of what the brochure says.

1. Is every upload hashed with SHA-256 before a human sees the file?

Hashing has to happen at the moment of receipt, server-side, before anyone — including the investigator — has the opportunity to view, rename, or move the file. If hashing is something a tech does later, the chain is already broken. Intelintake fingerprints every byte at upload and stores the hash alongside the asset; the hash is verified again at every transfer and download.

2. Are upload links single-use, time-bound, and case-scoped?

Generic submission portals invite spam, mismatched evidence, and confused chain attribution. A link should be tied to a specific case (or a specific canvass address, or a specific tipster), expire automatically, and only accept the asset it was created for. Intelintake generates per-link credentials with all three constraints by default; the alternative is a wide-open inbox by another name.

3. Is every access event logged with user, timestamp, IP, and user-agent?

A view counts. A download counts. A tag counts. A comment counts. If the log only captures "file uploaded" and "file downloaded," you are missing the granularity a defense attorney will ask for. Intelintake records every interaction with full attribution, and the log is queryable per asset, per case, or per user.

4. Can a witness upload from their phone in under two minutes without creating an account?

Friction at the front door is the single biggest reason agencies fall back to email for evidence collection. If the witness has to install an app, register, or wait for a verification code, you will lose half the footage you were promised. Intelintake's submission flow is a single tap from the SMS or email the resident receives — no account, no app, no password.

5. Are submission links deliverable over SMS as well as email?

Email reaches some witnesses. SMS reaches all of them. The intake system should support both as a first-class delivery channel for upload links, two-way replies, and follow-up. Intelintake handles both, with carrier-grade deliverability and a relay layer so investigator personal numbers are never exposed.

6. Is the audit log tamper-evident?

If a system administrator can edit the audit log, the audit log is not evidence. Tamper-evidence means the log is append-only, signed at rest, and exports include a verifiable signature. Intelintake's audit log meets this bar. Most consumer file-sharing tools (including Dropbox, Google Drive, and OneDrive — all referenced for descriptive purposes) do not.

7. Can tipsters communicate two-way without exposing investigator phone numbers?

A tip is the beginning of a conversation, not the end. The system has to support investigator replies — over SMS or email — that look like they came from the agency, not a detective's personal line. Intelintake routes every reply through an anonymized relay; investigators get a stable contact, tipsters get a reachable human.

8. Does the system produce a signed, court-ready export package?

When the case moves to discovery or trial, you should be able to hand the prosecutor a single archive containing every asset, every hash, and every access event — signed, timestamped, and verifiable by a third party. Intelintake produces this package on demand. If a vendor's answer is "we can give you a CSV of the audit log," keep looking.

9. How does the system hand off to your RMS?

Evidence does not live in the intake layer forever. At some point it has to settle into your agency's long-term records system with provenance intact. Intelintake integrates with major RMS platforms and supports a documented export schema for the rest, so the handoff carries the hash chain forward rather than starting over.

10. Are agency tenants isolated at the storage and indexing layer?

A vendor that claims multi-tenant support without isolation is one configuration error away from a cross-agency data exposure. Isolation has to be enforced at the database, the object store, and the search index — not just in the application logic. Intelintake's tenants are isolated end-to-end; another agency's evidence is never reachable from your account, and our own staff cannot cross the boundary without an auditable break-glass procedure.

Red flags during the evaluation

After running this checklist with dozens of agencies, certain patterns predict trouble downstream.

• The demo uses pre-populated sample data and the salesperson cannot upload a new file live.
• Audit logs are presented as a UI grid but cannot be exported with a signature.
• Submission links require the recipient to install an app or create an account.
• The vendor cannot answer "who can see my agency's data?" in one sentence.
• Pricing is per-file or per-gigabyte rather than per-seat or per-case, which encourages investigators to under-collect.
• The integration story with your RMS is "we have an API" with no examples of agencies using it.
• Security paperwork (SOC 2, CJIS posture, data-flow diagrams) takes longer than two weeks to produce.

Where Intelintake fits

Intelintake was built to be the intake layer this checklist describes — not because the category did not exist, but because the agencies we work with kept asking the same ten questions to vendors who could not answer them. We designed against the questions, not the brochure.

If you are evaluating tools and want to walk through this checklist with our live system, the demo link at the bottom of this site routes directly to our team. You will see a real upload, a real hash, and a real audit log — in that order, on a real production deployment.

If you are running this evaluation against another vendor, take the checklist with you. The questions matter more than the answers.