First Arriving

United States · www.firstarriving.com · 23 vendors

Resilience scores

Technology vendors

Services catalogue

5 services in catalogue across 2 categories; runs on 23 sub-vendors.

Insights

Last updated 2026-08-16 · revision 2

23 direct vendors, 232 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 6/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

First Arriving exhibits a medium level of migration readiness, scoring 60. The company's "SaaS Platform" and extensive use of "API-Based System Integrations" with over 130 partner systems are significant strengths, indicating a modular architecture that is generally well-suited for migration to new environments or cloud providers. The development of "Mobile App (iOS & Android)" and a roadmap for "AI-Assisted Operational Insights" further suggest a forward-looking approach to technology. The absence of specified "Data Residency Requirements" could simplify migration planning by reducing geographical constraints. However, several factors present challenges. The internal tech stack includes "WordPress", "WPBakery Page Builder", and "Elementor", which are typically associated with content management systems and might indicate parts of their infrastructure are not fully cloud-native or microservices-based, potentially requiring refactoring during a migration. The reliance on "SFTP" for data transfer, while functional, is a more traditional method compared to modern cloud-native data pipelines. The company utilizes "33 services" from various vendors, and while there is good "Vendor Geographic Diversity" (6 countries), the "Vendor Lock-in Risk" is "Unknown". A high number of services, even with diverse vendors, can lead to complex interdependencies and contract renegotiations during a migration, increasing effort and cost. Crucially, there is no available data on the company's financial stability (revenue concentration, growth history), which is vital for assessing its capacity to fund a potentially large-scale migration effort. Similarly, the "Regulatory Environment" is not specified, leaving potential compliance hurdles unknown.

Compliance

8 in-scope frameworks identified; showing 3.

PIPEDA — Partially Compliant

First Arriving explicitly serves Canadian clients (the website footer includes a Canadian Privacy Statement and Canadian Cookie Policy, and the company states it serves clients 'across North America'). PIPEDA (and provincial equivalents in Quebec under Law 25, Alberta under PIPA, and BC under PIPA) applies to private-sector organizations that collect, use, or disclose personal information in the course of commercial activities in Canada. Risk is Medium because: (1) the company has acknowledged Canadian operations by publishing Canadian-specific privacy policies, (2) Quebec's Law 25 (in effect since September 2023) has GDPR-like requirements including privacy impact assessments, data minimization, and breach notification that may not be fully addressed, (3) the Canadian Privacy Statement's completeness relative to Law 25 requirements cannot be fully verified from public sources.

Evidence: https://firstarriving.com/privacy-statement-ca/, https://firstarriving.com/cookie-policy-ca/, https://firstarriving.com/story/

GDPR (source) — Assessment Required

First Arriving is a US-based company (Ashland, VA) explicitly serving clients 'across North America' with no stated EU/EEA operations, offices, or customer base. Their Terms & Conditions state the service is 'controlled, operated and administered by First Arriving from our offices within the USA.' However, their MSA's definition of 'Privacy Laws' explicitly references 'Articles 25(1) and 26(1) of EU Directive 95/46/EC,' suggesting some historical or potential EU data processing awareness. The company maintains only a US Privacy Statement and a Canadian Privacy Statement — no EU/GDPR-specific privacy notice is published. Risk is Low because there is no evidence of EU/EEA customers or data subjects, but a formal assessment is warranted given the SaaS nature of the platform and the EU Directive reference in their legal documents. Consequences of non-compliance if EU data is inadvertently processed could include fines up to €20M or 4% of global annual turnover.

Evidence: https://firstarriving.com/privacy-statement-us/, https://firstarriving.com/terms-and-conditions/, https://firstarriving.com/cookie-policy-ca/, https://firstarriving.com/privacy-statement-ca/

HIPAA (source) — Assessment Required

First Arriving serves EMS agencies and integrates with EMS-specific systems including CAD (Computer-Aided Dispatch), RMS (Records Management Systems), and scheduling platforms. EMS agencies are healthcare providers under HIPAA, and their CAD/RMS systems routinely contain Protected Health Information (PHI) such as patient names, addresses, medical conditions, and incident details. First Arriving's platform ingests and displays real-time data from 130+ integration partners including EMS-specific systems (e.g., ESO, FirstWatch — both EMS data platforms). If any PHI flows through First Arriving's platform, it would qualify as a Business Associate under HIPAA, requiring signed Business Associate Agreements (BAAs) with covered entity clients. Risk is High because: (1) the platform explicitly serves EMS agencies, (2) it integrates with EMS data systems that handle PHI, (3) no public BAA template or HIPAA compliance statement is found, (4) failure to comply as a Business Associate can result in fines up to $1.9M per violation category per year, and (5) the public safety sector is an active area of HHS OCR enforcement.

Evidence: https://firstarriving.com/dashboards-ems/, https://firstarriving.com/integrations/eso/, https://firstarriving.com/integrations/firstwatch/, https://firstarriving.com/terms-and-conditions/, https://firstarriving.com/privacy-statement-us/

Financials

Three-year financials

Financial Resilience Score: 6/10

First Arriving demonstrates qualitative financial resilience through a recurring SaaS revenue model serving over 1,400 public-safety and government agencies, providing predictability and low customer concentration risk. The company's mission-critical dashboard and signage products, once integrated with CAD, RMS, staffing, and scheduling systems, generate high switching costs and sticky revenue. Its ecosystem of 140+ integration partners creates a defensible moat, and its public-sector customer base offers slow-cyclical demand that is relatively insulated from economic downturns. Recognition on the 2026 Inc. 5000 (ranked #1,742) and GovTech 100 (2026) provides independent validation of strong three-year revenue growth, with Inc. 5000 qualification implying revenue exceeding $2M in both the base and most recent year and growth likely in the 250-350% range over three years. However, the absence of any audited financial disclosure, unknown profitability, unknown leverage, and small-to-mid-market scale limit visibility into true resilience. Competition from much larger, better-capitalized players (ESO, Tyler Technologies, Motorola Solutions, Central Square) and dependence on municipal budget cycles and federal grant programs (AFG, SAFER) introduce meaningful risk. The score of 6 reflects a solid qualitative business model offset by limited financial transparency and small scale.

Key strengths: Recurring SaaS revenue across 1,400+ agency customers, High switching costs from deep CAD/RMS/scheduling integrations, 140+ integration partners creating ecosystem moat, Public-sector customer base with slow-cyclical demand, 2026 Inc. 5000 recognition (rank #1,742) validating strong growth, GovTech 100 (2026) inclusion, Diversified product line after ResponderMAX spin-out

Risk factors: No audited financial disclosure or public filings, Small-to-mid-market private company with limited capital access, Customer budgets tied to municipal funding and federal grant cycles, Competition from larger players (ESO, First Due, Tyler, Motorola, Central Square), Key-person concentration around founder Dave Iannone and Chair Alex Ford, ~100% North America revenue concentration with no international diversification

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report