Hosting and isolation
- Azure Government. RAID runs in Microsoft's US-sovereign cloud, physically and logically separate from the commercial Azure cloud.
- Dedicated per agency. Every customer gets its own database and application infrastructure. No customer data is shared or commingled with another agency's.
- Encryption. Traffic is encrypted in transit with TLS, and data at rest is encrypted by the Azure Government platform.
Identity and access
- Multi-factor authentication with TOTP authenticator apps, and phishing-resistant FIDO2 passkeys.
- Microsoft single sign-on for agencies on Microsoft 365. When SSO is enabled, disabling a person's agency account immediately removes their RAID access.
- Account lockout after repeated failed sign-in or MFA attempts, and an automatic sign-out after a period of inactivity.
- Password standards with complexity rules, rate-limited resets, and BCrypt hashing.
- Agency-controlled onboarding. New users are vetted and approved by your administrators. There is no open self-signup.
- Access requalification. Dormant accounts can be disabled automatically, and access is re-verified on a schedule.
Audit and accountability
- Complete audit trail. Sign-ins, role changes, membership changes, account actions, and security events are logged.
- Long-term log retention. Audit logs are archived to append-only storage and retained for at least a year.
- Security alerting. Administrators can receive email digests of security events such as lockouts, role changes, and disabled accounts.
- Readership records. Every product records who received it and who opened it.
Protecting disseminated products
- Recipient watermarking. Products and attachments carry agency watermarks tied to the recipient, which deters unauthorized sharing and helps attribute a leaked product to the account it was issued to.
- Need-to-know delivery. Products go only to the communities an analyst targets, so a restricted product never reaches people outside that audience.
CJIS Security Policy alignment
RAID's technical controls are mapped to the FBI CJIS Security Policy, including advanced authentication, session and lockout controls, auditing and accountability, and protection of information in transit and at rest. Hosting in Azure Government lets agencies inherit Microsoft's platform-level controls.
There is no CJIS "certification" for software. Compliance is assessed for each agency's use, together with your CJIS Systems Agency. Some requirements, such as security awareness training and personnel screening, are organizational. We will walk your security staff through the control mapping as part of an evaluation.
Security questions during an evaluation
For how RAID fits 28 CFR Part 23 and the CJIS Security Policy in a cloud deployment, see 28 CFR Part 23 and CJIS for cloud intelligence sharing.
Security reviewers can request the control mapping, architecture details, and network allowlists by emailing sales@raidplatform.io.