Compliance isn't a policy. It's the process.
Background check and fingerprint data are among the most sensitive information there is. Every step of a Vettr program carries an obligation to the candidate, to your organization and to the law.
Talk to Our TeamHow Vettr handles compliance
The structure our whole process is built on, not a document we reach for when something goes wrong.
CJIS-aligned handling
Fingerprint data is handled in line with the FBI CJIS Security Policy for access, handling and transmission of criminal justice information.
Chain of custody
Every step from intake to results is documented, giving you a complete audit trail for regulators, internal review or any later query.
Consent management
Candidate consent is documented before any check runs, retained as required and available for audit or legal review.
Data retention
Biometric data isn't kept beyond what submission and reconciliation require. Results are retained per applicable law and your documented policy.
Candidate privacy
Personal information is used only to run the check and is shared only with the relevant repository and your authorized contacts.
Secure result delivery
Results go only to the authorized contacts you name, never to candidates directly unless you request it and they've authorized it.
CJIS Security Policy as the baseline
Framework at a glance
FBI CJIS Security Policy
Baseline standard
Candidate consent
Required before any check
Chain of custody
Documented end to end
Biometric retention
Submission only
Result delivery
Authorized contacts only
Audit trail
Full lifecycle record
The FBI's Criminal Justice Information Services (CJIS) Security Policy sets minimum requirements for accessing, using and handling criminal justice information, including fingerprint data submitted to FBI repositories. Vettr treats it as the baseline, not an optional framework.
That includes:
- Personnel security: vetting everyone who handles fingerprint data
- Physical security of capture and transmission equipment
- Access controls limited to authorized personnel
- Documented incident response procedures
- Audit logs of system access and actions
Need documentation for your own review? Just ask.
What it means for your organization
Vettr supports your compliance obligations. It doesn't take them off your plate or shift liability.
You name the contacts
Results are delivered only to the authorized contacts you designate.
Consent on file
Vettr manages consent records and makes them available to you for audit.
Chain-of-custody confirmation
Your HR or compliance team gets confirmation for every check.
Records that fit
Structured for your regulatory reporting, not generic output.
Candidate privacy and rights
Candidates keep their rights under applicable law, including the right to review and dispute information held by a repository if there's an adverse finding. Vettr runs checks accurately and securely; employment and licensing decisions, and how to act on results, rest with your organization and its legal advisers.
- Candidates are told why information is collected before capture
- Written consent is obtained before any check is processed
- Biometric data isn't kept beyond submission requirements
- Candidates can request documentation of their submission
Common compliance questions
How is fingerprint data sent to the FBI?
Live Scan data is transmitted electronically over encrypted, approved channels to the FBI's Next Generation Identification (NGI) system or the relevant state repository (FDLE in Florida). FD-258 cards are mailed to the FBI's designated processing address in line with FBI requirements.
Does Vettr store fingerprint biometrics?
No. Biometric data isn't kept in Vettr systems beyond what the submission requires. Once a submission is transmitted and confirmed, the biometric record isn't held on Vettr equipment or systems.
Who can receive background check results?
Only the authorized contact your organization names at submission: a named individual with authority to receive the information. Results aren't shared with anyone else, including the candidate, unless you authorize it and the law permits it.
What documentation do you provide for audits?
For every check: submission confirmation with reference number and timestamp, chain-of-custody documentation, consent record confirmation and result delivery confirmation. We can discuss additional reporting formats for specific audit needs.
How do you handle a suspected security incident?
We notify affected organizations and relevant authorities as required by law and follow documented incident response procedures aligned with the CJIS Security Policy. Contact us directly with any security concern.
We'll walk you through it.
Have specific compliance or security requirements? We'll provide documentation to support your internal review.
Talk to Our Team- CJIS-aligned handling
- Documented consent
- Full chain of custody