Skip to content
Cjis

Cjis.io security and how we protect your compliance record

Your compliance record shows how your organization protects criminal justice information, so it deserves the same care. This page explains what Cjis stores, what it never stores and how access to your workspace is controlled.

Signed vendor agreement with a blue pen, a signature stamp and ink pad on a prosecutor's office desk with manila case files

No CJI is ever stored in Cjis

Cjis holds compliance records: control status, policies, training and background check dates, and evidence such as configuration screenshots and signed agreements. It never holds criminal justice information. Every upload shows a notice that the file must not contain CJI, and a file name check flags names that suggest case files, records or reports so you can stop before you upload.

  • Compliance metadata and evidence only
  • Upload notice on every evidence file
  • File name check before the file is saved
Check my readiness

US hosting with encryption in transit and at rest

Workspaces are hosted in the United States. Connections use TLS, and stored data and evidence files are encrypted at rest. Backups are encrypted and kept in the US as well.

  • Hosting in the United States
  • TLS for every connection
  • Encryption at rest for data, files and backups

Roles, audit log and single sign-on

You decide who sees your record. On Pro and Enterprise, roles and permissions limit who can view, edit or approve, and the audit log records who changed what and when. Enterprise adds SAML SSO with your identity provider, so access follows your own joiner and leaver process.

  • Roles and permissions on Pro and up
  • Audit log of changes on Pro and up
  • SAML SSO on Enterprise
  • Multi-factor authentication for user accounts on every plan

Export and deletion

Your compliance data stays yours. Export your records, policies, personnel register and evidence index at any time. When you leave, ask us to delete your workspace and we remove it, as described in our privacy policy.

  • Full export on every plan
  • Deletion on request
  • No selling or sharing of your data for advertising

Report a security issue

If you find a vulnerability in cjis.io, email [email protected] with the steps to reproduce it. Please do not access other customers' data, do not run tests that degrade the service, and give us reasonable time to fix the issue before you share it. We confirm receipt and keep you informed.

Email [email protected]

What this page does not claim

Cjis is an independent compliance tool and is not affiliated with, endorsed by or certified by the FBI or the CJIS Division. Because Cjis never stores CJI, it is not a system that processes CJI under the policy. To learn how the policy treats systems that do, read our guides on CJIS encryption requirements and CJIS password requirements, or see the features that help you prove those controls.

/cjis-compliance-requirements CJIS compliance requirements for vendors and agencies in every policy area CJIS compliance requirements by area, from MFA and encryption to training and agreements, for vendors and agencies. Check your readiness against each one. /cjis-password-requirements CJIS password requirements and advanced authentication CJIS password requirements follow NIST SP 800-63B style rules, plus MFA for access to CJI. Learn what auditors check and track it in one place. Get started. /cjis-compliant-software CJIS compliant software and what it takes for a vendor CJIS compliant software depends on vendor controls and agency approval, not a label. See what agencies check and build the record to show them. Get started.