Stated honestly, dated, and qualified.

Where we stand.

Each item carries a status and a review date: available now, in remediation, or planned. Reviewed 2026-05-15. Historical snapshots are preserved and available on request.

Built to be checked, not trusted.

Cryptographic primitives chosen against NIST guidance, and the engineering discipline that makes claims provable. Every item below is in code today.

What we do not yet promise.

Bidding on a contract whose requirements we cannot meet would violate FAR 52.203-13. We disclose what we cannot do. That is the discipline.

1. 01
   We are not yet FedRAMP-authorized for cloud delivery. We offer the on-prem deployment first. Cloud delivery follows agency sponsorship and an ATO grant.
2. 02
   We do not yet hold a CMMC Level 2 certificate. Gap analysis is complete and consolidation is in progress. The first defensible response is targeted for 2026.
3. 03
   We do not yet ship a FIPS 140-3 validated cryptographic module. Migration is documented. The CMVP queue is the bottleneck.
4. 04
   We will not handle classified data or controlled unclassified information on any network we operate until federal certification is complete.
5. 05
   We make no representations about token pricing or token-economic returns to anyone, ever. Our commercial model is denominated in dollars, on standard contract vehicles.