Your data is protected by the same infrastructure trusted by the U.S. Department of Defense.
VSTracking was built by victim advocates who understand the sensitivity of the information you handle every day. We take the security of your data as seriously as you take the safety of the people you serve.
Infrastructure & Encryption
All VSTracking client data is hosted exclusively on Amazon Web Services GovCloud (US), an isolated cloud region designed to host sensitive government data and regulated workloads. AWS GovCloud meets the strictest U.S. government security and compliance requirements, including FedRAMP High baseline authorization. No client data is ever stored or processed outside of the GovCloud environment.
All data is encrypted in transit and at rest using FIPS 140-2 and FIPS 140-3 validated cryptographic modules, the same encryption standard required by the FBI's Criminal Justice Information Services (CJIS) Security Policy and used by federal law enforcement agencies nationwide.
Security Pillars
All data is encrypted at rest and in transit using federally validated cryptographic standards. Your client information is protected whether it's being stored in our database or traveling between your browser and our servers.
VSTracking includes six built-in access roles, from full administrative control to read-only and reports-only, so your agency can assign each user the appropriate level of access. Advocate-limited roles ensure that staff members see only the cases they are assigned to. Every access event is logged in a comprehensive audit trail, and multi-factor authentication is available for administrative access.
Every Advocate Advantage employee with access to client data undergoes a national fingerprint-based background check and completes annual CJIS Security Awareness Training and certification through CJISOnline.com, the same training required of law enforcement personnel.
Your data never leaves U.S. soil. All VSTracking client data is stored and processed exclusively within AWS GovCloud's U.S. regions, operated by screened U.S. persons. We are a 100% USA-based company with no offshore operations or data processing.
CJIS Security Policy Alignment
Many of our clients are law enforcement-based victim advocates and criminal justice agencies that must comply with the FBI's Criminal Justice Information Services (CJIS) Security Policy. VSTracking's security practices are aligned with the CJIS Security Policy's requirements, including:
We are available to sign the CJIS Security Addendum with any law enforcement agency that requires it as part of their vendor compliance process.
Third-Party Data Isolation
VSTracking does not route your data through third-party automation platforms, consumer integration services, external analytics tools, or external artificial intelligence providers. All client data remains within our AWS GovCloud environment at all times.
Some case management platforms advertise integrations with third-party automation tools that route data through commercial servers lacking government-grade security controls. When victim data flows through services that have not signed a CJIS Security Addendum, do not maintain FIPS-validated encryption, and are not operated by background-checked personnel, the convenience of automation comes at the cost of the confidentiality protections your agency is required to maintain.
VAWA, VOCA, and FVPSA all require grantees to make reasonable efforts to prevent the inadvertent disclosure of victim personally identifying information, especially when using any third-party database or system managed by an outside company. VSTracking is designed to keep your data within a single, secure, government-grade environment so you never have to question whether a third-party service is putting your compliance at risk. This includes artificial intelligence and analytics features that process your data through external machine learning providers.
For Grant Administrators
If you're evaluating VSTracking as part of a VOCA or VAWA-funded program, here's what you need to know:
We're happy to discuss our security practices in detail, provide documentation for your compliance files, or sign a CJIS Security Addendum for your agency. Contact us or schedule a call to learn more.
