One system. PHQ to decision.
Litmus is the newest part of Strata.
03Nothing retyped. Nothing missed.
Every area of their life, in one file.
Clarified. No phone tag.
Applicants fix answers in their portal. Only what changed comes back.
Every agency in range.
Set a radius around every address. Requests go out and replies land in the case.
Nothing stalls unnoticed.
Every open case, sorted by how long it has waited.
INVESTIGATIONSLitmus starts it. You finish it.
Litmus drafts the narrative. Your investigator makes the call.
LITMUS DRAFTCJI stays in the vault.
Criminal history lives in a separate CJIS Vault on AWS GovCloud.
SOC 2 compliant. Built to CJIS.
Encrypted, vetted and audited at every layer.
Type I and Type II reports available to your agency
They make your academy.
Litmus, SOC 2 and CJIS
Is Litmus SOC 2 compliant?
Yes. Type I and Type II reports are available to your agency.
Is Litmus CJIS compliant?
Litmus is mapped to all 302 requirements of CJIS Security Policy v6.1, control by control. Of those, 222 are met by Performance Protocol, 42 are inherited from AWS GovCloud, 32 are shared with your agency and 6 sit with your agency, mainly its own devices and queries. Zero-cycle requirements due by September 30, 2027 are already in place. The full control matrix is available on request.
Where is our criminal history stored?
Only in the CJIS Vault, in a dedicated AWS GovCloud (US-West) account. It is encrypted with AES-256 under a key dedicated to your agency, using FIPS 140-3 validated modules. The Litmus workflow holds only reference numbers.
Does Litmus run NCIC or III queries?
No. Your agency runs them in its own systems, under its own ORI. Your investigators upload the results to the Vault, where Litmus stores, protects and displays them.
Who can see our CJI?
Only users your agency approves, signed in with a passkey. Passkeys are phishing-resistant and meet NIST AAL2. The Vault checks its own access list on every request. Sessions lock after 30 minutes of inactivity, and every view is written to a write-once audit log kept for 400 days.
Can Performance Protocol staff see our data?
Not by default. Staff hold no standing access to your CJI. Anyone who can reach the system is fingerprinted through your state's CJIS Systems Agency, trained every year, has signed the CJIS Security Addendum and is re-vetted every two years. Any help that needs access is time-limited, recorded and shows in your audit trail.
When Litmus drafts the narrative, where does our data go?
Nowhere outside the Vault. Drafting that uses CJI runs inside the Vault in AWS GovCloud. Nothing leaves GovCloud, nothing is used for training, and every draft is logged.
What stays with our agency?
The responsibilities you already have. You name your TAC or LASO and your Vault administrators, fingerprint and train your own users, secure the devices used to view CJI, and set your retention schedule.
Do we need Strata to use Litmus?
Yes. Litmus is part of Strata. It is not sold separately. Background investigation runs in the same system as your recruiting, from first application to final decision.
END DUPLICATE ENTRY
Get to the truth faster.