FINDER® operates inside criminal justice environments, which means it answers to criminal justice standards. This page covers how the platform supports your CJIS obligations, how your agency keeps control of its own data, and what we can put in writing when your auditor asks.
Compliance is a collaboration between your agency, your personnel, your contractors, and your vendors. The real test is whether your agency passes a CJIS audit on its policies, its user management, and its vendor management.
Our job is to make our part of that straightforward: screened personnel, documented controls, and records you can produce on request rather than assurances you have to take on faith.
Personnel who may access a customer system have completed background checks under the CJIS Security Policy. Fingerprint ORI is available on request.
CJIS Security Awareness training is completed and maintained by our team. Certifications are available on request.
Security Addendums are executed and kept on file. We sign yours.
We support customer-requested background checks, audits, and documentation requests as a standard part of the relationship, not as an escalation.
CJIS Security Policy v6.0 control IA-2 requires advanced authentication for access to criminal justice information. Email one-time passcodes do not satisfy that control, and FINDER has moved all users to an authenticator app or a hardware token.
Enrollment is prompted, not a lockout. Users who have not enrolled are prompted at next sign-in and continue into the platform once enrolled. Agency administrators can see enrollment status for their own users.
Data your agency contributes remains your agency’s data. Contribution does not transfer ownership. FINDER uses contributed data to operate, support and improve the platform and to share it with authorized agencies, and never sells it.
Sharing across the network is governed by your agency’s agreement with FINDER. Your agency controls what it contributes and can opt out of national sharing programs.
Records flagged confidential in your source system are not read. A record flagged after loading is removed. When your agency corrects a report, the change syncs on the next run. Your records stay the source of truth.
When your agency leaves the network, it can request removal of its contributed data as set out in the FINDER Terms, and the uploader on your network is terminated.
Accounts exist only for people your agency approves, whether through your agency administrator, an Active Directory roster your administrator signs off on, or your agency identity provider. Agencies not yet on the network go through a separate review by the FINDER team.
Permissions are assigned by role. Add-on modules such as Public Records and AdTech are enabled per agency and per user, never opened by default.
Access is granted to authorized agency personnel for criminal justice purposes, and searches are logged with user, timestamp, and query. Agency administrators can run audits and logs for their own agency, with a pre-filter for internal and agency audits.
Agency administrators approve and deny account requests, edit and delete accounts, expunge records, and run audits at the access level your agency assigns, without opening a support ticket. Permission and deactivation changes take effect immediately.
FINDER provides query access to N-DEx under your agency’s own credential. N-DEx records are not held, copied, or resold by FINDER. Results return to the querying user under federal terms of use.
Person and motor vehicle public records sourced through idiCORE. Compliance, including permissible use under the Driver’s Privacy Protection Act, runs through the FINDER Terms and any agreement the provider requires. It is not a screening product and does not return driving history or license status.
Commercially available advertising identifier data sourced through Sigilite, queried for a defined area and time window. Your agency determines permissible use under its own policy and applicable legal process. Results are investigative leads based on masked advertising identifiers and are subject to provider availability.
FINDER runs in AWS GovCloud, a cloud environment built to meet federal compliance requirements, which provides data protection, scalability, and resilience.
Customer data is encrypted both in transit and at rest. Specific standards and configuration detail are available to your IT staff on request.
The environment is backed up daily and monitored continuously.
Implementation files, bulletins, hotlists, and other transfers move through FINDER secure transfer, including an SFTP server that is FIPS 140-2 compliant and secured end to end, consistent with the requirements for transferring CJIS data. Records and passwords are never sent by ordinary email.
FINDER is a web application, so there is no client software on user machines. The only component on your network is the uploader on an existing agency Windows host. It reads with read-only credentials and sends records outbound on a schedule you set, so no inbound firewall change is required.
The architecture is designed to meet the technological directives established by the federal government for sharing law enforcement data.
If your agency is running a vendor assessment, tell us what you need. Certifications, ORI, and executed addendums are available on request. We would rather answer the hard questions early than late.
This page describes current practices for information only. The FINDER Terms govern.
Supporting law enforcement for over 20 years.
© 2026 FINDER® Software Solutions LLC