Compliance Commitment
SOC2 Compliance
Kaseware is SOC 2 Type 2 compliant. SOC 2 is an accreditation from the American Institute of Certified Public Accountants—an independent third-party examination. This audit demonstrates our compliance in two trust service principles: security and confidentiality. In other words, their evaluation can play an important role in:
- Oversight of the organization.
- Vendor management programs.
- Internal corporate governance and risk management processes.
- Regulatory oversight.
CJIS Compliance
Kaseware adheres to all state CJIS policies in the states that it supports. CJIS stands for the Criminal Justice Information Service Division. CJIS provides criminal justice information (CJI) to local, and federal law enforcement and criminal justice agencies access. Specifically, CJI includes fingerprint records and criminal histories. The policies set forth by CJIS apply to all agencies and private contractors who process CJI. They must sign the CJIS Security Addendum, a uniform agreement approved by the US Attorney General to ensure security and confidentiality. At the same time, the agreement limits CJI use to the purposes for which it was provided.
ISO 27001: Information Security
Kaseware is ISO 27001 certified, affirming our commitment to the highest standards of information security. This globally recognized certification ensures that our systems, policies, and controls are designed to protect sensitive data from threats and vulnerabilities. For customers, it means confidence that their information is safeguarded with proven, continuously audited practices that prioritize integrity, confidentiality, and availability.
ISO 27701: Privacy Management
Kaseware is also ISO 27701 certified, which extends our security framework to include robust privacy management. This certification demonstrates that we handle personally identifiable information (PII) with transparency and care, meeting global privacy requirements. It reinforces our promise to uphold data privacy and compliance, helping customers operate confidently in regulated, mission-critical environments.
Listed on the Data Privacy Framework (DPF)
Kaseware is certified for the Data Privacy Framework (DPF) Program, developed by the U.S. Department of Commerce and the European Commission. The DPF provides U.S. organizations with the means and set of requirements for data transfers and data protection to be consistent with EU, UK, and Swiss law.
TX-RAMP Certification
Kaseware has achieved TX -RAMP Certification, reaffirming our commitment to security compliance for law enforcement and threat analysis agencies in Texas.
Our Commitment to Security
and Privacy
Data and privacy protection are our number one priority. We validate our platform with independent third-party audits to ensure we exceed the highest industry standards. To explore the full details of our security practices, certifications, and ongoing commitments, visit our dedicated Kaseware Trust Center.
Our Service Providers
Kaseware proudly holds our service providers to our same extremely high standards. For example, our data centers and other key suppliers undergo regular audits to validate their practices. We review these reports carefully and proactively address any areas of concern.
Compliance and Security FAQ
Is Kaseware compliant with industry security standards like SOC 2, CJIS, and ISO 27001 and ISO 27701?
Yes. Kaseware maintains a comprehensive security and compliance program, including SOC 2 Type II attestation, and ISO 27001, and ISO 27701 certifications, with support for CJIS requirements. Our security program follows a risk-based approach aligned with industry best practices. For additional information regarding Kaseware’s Security, Privacy, and Compliance practices, please visit our Trust Center.
How is client data encrypted and protected?
Customer data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher, meeting CJIS Security Policy requirements for protecting criminal justice information. Encryption keys are managed separately from the data they protect, and access is limited to authorized systems and personnel.
How do you manage user authentication and access control?
Kaseware supports Single Sign-On (SSO), SAML 2.0, OAuth/OIDC integrations, Multi-Factor Authentication (MFA), Role-Based Access Control (RBAC), so agencies can enforce their own authentication policies and limit access to what each user’s role requires.
How do you protect sensitive law enforcement and investigative information?
The platform provides granular permissions, case-level access controls, need-to-know access controls, data segmentation, and comprehensive audit logging to protect sensitive investigative information.
What audit logging and monitoring capabilities are available?
Kaseware maintains comprehensive audit logs capturing user activities, data modifications, authentication events, and administrative actions consistent with NIST SP 800-53 audit and accountability controls and CJIS Security Policy requirements. Logs are protected against unauthorized access or alteration and support investigations, compliance reviews, and chain-of-custody requirements.
How do you conduct vulnerability management and penetration testing?
Regular vulnerability scanning, secure code reviews, dependency monitoring, and independent third-party penetration testing are conducted. Identified findings are prioritized and remediated according to risk severity. These security practices and controls are also independently verified through third-party audits. For additional details, please visit the Kaseware Trust Center.
How do you ensure business continuity and disaster recovery?
Kaseware maintains documented business continuity and disaster recovery processes designed to support service availability and recovery in the event of an incident, consistent with NIST contingency planning practices. Backups, recovery procedures, and failover capabilities are tested on a regular basis to confirm the organization can restore service and data access when needed.
Can the platform support CJIS Security Policy requirements?
Yes. Kaseware supports CJIS-aligned security controls including authentication, audit logging, access controls, encryption, personnel security requirements, and secure hosting environments.
How is client data segregated in a multi-tenant environment?
Customer environments are logically segregated to help ensure each customer’s data remains isolated and accessible only to authorized users.
What security controls protect APIs and integrations?
APIs and integrations are protected through industry-standard authentication, authorization, encryption, and monitoring controls.
Does Kaseware's AI (Kase Agent) use client data to train AI models?
No. Kaseware does not use customer data to train AI models. Kase Agent uses Azure Services, and Microsoft does not use that data to train its models either. All AI traffic stays within Kaseware’s security boundary, and customer data is vectorized before it’s sent to the model rather than passed through in raw form.
How does Kaseware control access to AI features and sensitive data?
Organizations can enable, disable, or manage AI capabilities based on their operational and security requirements.
GET A LIVE, CUSTOMIZED DEMO
You’ll quickly see how Kaseware can improve your investigations and help you achieve mission success.