{
	"metadata": {
		"version": "1.0.5",
		"lastUpdated": "2026-10-17T00:00:00Z",
		"updateSource": "Paramify CR26 20x Class C program",
		"responsibleOfficial": {
			"name": "Mehmet Yigit Guney",
			"title": "Chief Executive Officer",
			"email": "yigit@cleat.ai",
			"phone": "855-961-5108"
		}
	},
	"serviceIdentification": {
		"fedRampPackageId": "FR2700857472",
		"ueiNumber": "L6FVP55CMYA6",
		"providerName": "CLEATUS, Inc.",
		"serviceName": "CLEATUS",
		"serviceAcronym": "CLEATUS",
		"serviceDescription": "CLEATUS is a cloud-based Software-as-a-Service (SaaS) platform that provides AI-powered government contracting business development and proposal support. Users discover and evaluate federal contracting opportunities, manage capture and pipeline activities, generate and refine proposal content, and automate recurring business development workflows. The system is hosted in AWS GovCloud (US), with us-gov-west-1 as the primary region and us-gov-east-1 as a warm standby, and it processes, stores, and transmits Controlled Unclassified Information (CUI) for organizations that support the Department of Defense. The system does not process classified information.",
		"certificationType": "20x",
		"website": "https://www.cleat.ai",
		"logo": "https://www.cleat.ai/images/logo/logo-cleatus-small-500.png"
	},
	"serviceProperties": {
		"serviceType": ["SaaS"],
		"deploymentModel": "Public Cloud",
		"nextOngoingCertificationReportDate": "2026-11-25",
		"trustCenter": {
			"repositoryType": ["Trust Center"],
			"url": "https://trust.paramify.com/cleatus",
			"repositoryDescription": "CLEATUS FedRAMP 20x Class C trust center on Paramify: certification data, deliverables, and access requests.",
			"authenticationRequired": true,
			"accessRequestInstructions": "Public deliverables download without an account. For restricted deliverables, select Request Access in the trust center and sign in. CLEATUS reviews each request in the trust center."
		},
		"secureConfigurationGuidance": {
			"repositoryType": ["Secure Configuration Guidance"],
			"url": "https://trust.cleat.ai/secure-configuration-guide.md",
			"repositoryDescription": "CLEATUS Secure Configuration Guide, also published as https://trust.cleat.ai/secure-configuration-guide.json.",
			"authenticationRequired": false
		},
		"additionalRepositories": [
			{
				"repositoryType": ["System Authorization Documentation"],
				"url": "https://trust.cleat.ai/certification-data-index.json",
				"repositoryDescription": "Machine-readable index of every public CLEATUS FedRAMP certification data file, with the URL and format of each JSON and Markdown resource.",
				"authenticationRequired": false
			}
		]
	},
	"contactInformation": [
		{
			"contactType": "Privacy Point of Contact",
			"contactName": "Mehmet Yigit Guney",
			"contactEmail": "yigit@cleat.ai",
			"contactPhone": "855-961-5108"
		},
		{
			"contactType": "Information System Security Officer",
			"contactName": "Erik Sherman",
			"contactEmail": "erik@cleat.ai",
			"contactPhone": "855-961-5108"
		},
		{
			"contactType": "System Owner",
			"contactName": "Erik Sherman",
			"contactEmail": "erik@cleat.ai",
			"contactPhone": "855-961-5108"
		},
		{
			"contactType": "System Point of Contact - Technical",
			"contactName": "Erik Sherman",
			"contactEmail": "erik@cleat.ai",
			"contactPhone": "855-961-5108"
		},
		{
			"contactType": "Content Approver",
			"contactName": "Mehmet Yigit Guney",
			"contactEmail": "yigit@cleat.ai",
			"contactPhone": "855-961-5108"
		},
		{
			"contactType": "System Point of Contact - Management",
			"contactName": "Erik Sherman",
			"contactEmail": "erik@cleat.ai",
			"contactPhone": "855-961-5108"
		},
		{
			"contactType": "Prepared By",
			"contactName": "CLEATUS, Inc.",
			"contactEmail": "info@cleat.ai",
			"contactPhone": "855-961-5108"
		},
		{
			"contactType": "Security",
			"contactName": "CLEATUS Security",
			"contactEmail": "security@cleat.ai",
			"contactPhone": "855-961-5108"
		},
		{
			"contactType": "Sales",
			"contactName": "CLEATUS Sales",
			"contactEmail": "info@cleat.ai",
			"contactPhone": "855-961-5108"
		}
	],
	"assessor": {
		"name": "A-LIGN",
		"assessorID": "138665"
	},
	"thirdPartyInformationResources": {
		"certified": [
			{
				"fedRampCertifiedThirdPartyInformationResource": "F1603047866",
				"useCase": "Hosts the whole system: compute, storage, database, networking, and security services in us-gov-west-1, with us-gov-east-1 as the warm standby."
			},
			{
				"fedRampCertifiedThirdPartyInformationResource": "FR1812058188",
				"useCase": "Source control, code review, and the GitHub Actions builds that publish release images to the in-boundary Amazon ECR. FedRAMP Low, below the Moderate baseline. Compensating measures: the OIDC trust is scoped to the repository; branch protection and role-based access use SSO with multi-factor authentication; the ECR repositories are immutable; images are scanned by Amazon Inspector; and production pulls only from in-boundary ECR."
			},
			{
				"fedRampCertifiedThirdPartyInformationResource": "F1206081364",
				"useCase": "Identity provider for CLEATUS staff, with enforced multi-factor authentication, and staff email and documents."
			},
			{
				"fedRampCertifiedThirdPartyInformationResource": "FR2201340492",
				"useCase": "Security awareness and role-based training for CLEATUS staff. It holds no system or customer data and has no connection to the boundary."
			},
			{
				"fedRampCertifiedThirdPartyInformationResource": "FR2428769635XL",
				"useCase": "Governance, risk, and compliance platform where CLEATUS maintains its security plan, certification package, and control evidence. It receives approved compliance evidence from in-boundary collectors and holds no customer data."
			},
			{
				"fedRampCertifiedThirdPartyInformationResource": "FR1823447014",
				"useCase": "Receives one-way security and operational alerts from in-boundary monitoring through incoming webhooks. No CUI is sent."
			},
			{
				"fedRampCertifiedThirdPartyInformationResource": "FR2525556241",
				"useCase": "Collects compliance evidence through a read-only cross-account audit role. FedRAMP 20x Low, below the Moderate baseline. Compensating measures: the role requires an external ID, carries only read-only audit permissions, sessions last at most one hour, and CloudTrail records every call. It holds no customer data."
			}
		],
		"nonCertified": [
			{
				"name": "Commercial Public Data Bridge (Vercel)",
				"provider": "Vercel Inc.",
				"useCase": "Twice-daily one-way transfer of allowlisted public procurement data from the CLEATUS commercial environment into an in-boundary S3 bucket. It carries no CUI.",
				"website": "https://vercel.com"
			},
			{
				"name": "Have I Been Pwned Pwned Passwords API",
				"provider": "Have I Been Pwned",
				"useCase": "Screens new passwords against known breached passwords. Only the first five characters of the SHA-1 digest leave the boundary.",
				"website": "https://haveibeenpwned.com"
			},
			{
				"name": "Intercom Customer Support Messaging",
				"provider": "Intercom, Inc.",
				"useCase": "Customer support messaging widget on the sign-in page and support interface. A persistent notice prohibits CUI in the channel, each messenger open requires a recorded CUI-prohibition attestation, and file attachment, drag and drop, and file paste are blocked.",
				"website": "https://www.intercom.com"
			},
			{
				"name": "npm Registry (build-time package fetch)",
				"provider": "npm, Inc.",
				"useCase": "Supplies public JavaScript packages to the image build outside the boundary, pinned by a lockfile with integrity hashes. No data is sent to it.",
				"website": "https://www.npmjs.com"
			},
			{
				"name": "Stripe Payment Processing",
				"provider": "Stripe, Inc.",
				"useCase": "Payment processing. Card data goes from the browser directly to Stripe, and CLEATUS servers handle only Stripe object identifiers and billing metadata, with CUI prohibited in that metadata. Stripe is PCI DSS Level 1 with SOC 2 Type II.",
				"website": "https://stripe.com"
			}
		]
	},
	"certifiedServices": [
		{
			"serviceName": "Opportunity Discovery",
			"serviceDescription": "AI-matched federal opportunities based on the capture profile, with fit and compliance analysis",
			"securityCategory": "Moderate (FIPS 199), the same as the offering (SSP 1.1 Table 3-1)",
			"dateAvailable": "2026-08-17"
		},
		{
			"serviceName": "Opportunity Finder and Advanced Contract Search",
			"serviceDescription": "Search and filters over SAM.gov and other public procurement sources",
			"securityCategory": "Moderate (FIPS 199), the same as the offering (SSP 1.1 Table 3-1)",
			"dateAvailable": "2026-08-17"
		},
		{
			"serviceName": "Market Intelligence",
			"serviceDescription": "Agency hierarchies, contracting officers, competitor award history, forecasts and recompete scoring",
			"securityCategory": "Moderate (FIPS 199), the same as the offering (SSP 1.1 Table 3-1)",
			"dateAvailable": "2026-08-17"
		},
		{
			"serviceName": "Contract Breakdown and Document Hub",
			"serviceDescription": "Automatic shredding of the solicitation package (base, amendments, attachments) into one breakdown; document storage",
			"securityCategory": "Moderate (FIPS 199), the same as the offering (SSP 1.1 Table 3-1)",
			"dateAvailable": "2026-08-17"
		},
		{
			"serviceName": "Proposal Writer",
			"serviceDescription": "Agentic proposal drafting: compliance matrices, win themes, outlines, structured volumes",
			"securityCategory": "Moderate (FIPS 199), the same as the offering (SSP 1.1 Table 3-1)",
			"dateAvailable": "2026-08-17"
		},
		{
			"serviceName": "Pursuit Management and Teams",
			"serviceDescription": "Shared pipeline from capture to award, roles, notifications, activity",
			"securityCategory": "Moderate (FIPS 199), the same as the offering (SSP 1.1 Table 3-1)",
			"dateAvailable": "2026-08-17"
		},
		{
			"serviceName": "Contractor Teaming",
			"serviceDescription": "Partner and supplier discovery and outreach",
			"securityCategory": "Moderate (FIPS 199), the same as the offering (SSP 1.1 Table 3-1)",
			"dateAvailable": "2026-08-17"
		},
		{
			"serviceName": "GovCon Copilot (AI agents)",
			"serviceDescription": "Conversational agents that plan, reason, and execute multi-step work with the platform tools",
			"securityCategory": "Moderate (FIPS 199), the same as the offering (SSP 1.1 Table 3-1)",
			"dateAvailable": "2026-08-17"
		},
		{
			"serviceName": "AI Workflows",
			"serviceDescription": "Event-driven automations for capture and BD operations (triage, summaries, reporting, reminders)",
			"securityCategory": "Moderate (FIPS 199), the same as the offering (SSP 1.1 Table 3-1)",
			"dateAvailable": "2026-08-17"
		},
		{
			"serviceName": "API",
			"serviceDescription": "Programmatic access to the platform for customer integrations",
			"securityCategory": "Moderate (FIPS 199), the same as the offering (SSP 1.1 Table 3-1)",
			"dateAvailable": "2026-08-17"
		}
	],
	"x-relevantPoliciesAndProcedures": "The 18 FedRAMP policies and 18 procedures in SSP Appendix C, version 1.1, approved with SSP 1.1 on 2026-09-29. The policy and procedure reference is published at https://trust.cleat.ai/policy-procedure-reference.json.",
	"x-informationResources": "The authorization boundary spans two AWS GovCloud (US) regions in one account: us-gov-west-1 is the primary region and us-gov-east-1 is a warm standby with its own load balancer, application services, Aurora Global Database reader, and S3 and ECR replicas. Application services run on ECS Fargate and Lambda behind WAF-protected Application Load Balancers. Customer data is stored in Amazon Aurora PostgreSQL and Amazon S3. AI inference and document processing use Amazon Bedrock, SageMaker, and Textract inside the boundary. Two EC2 hosts run the security monitoring and code analysis tools. Better Auth, the customer identity provider, runs inside the boundary.",
	"x-informationFlows": "The system is categorized Moderate under FIPS 199. Customer browsers connect over HTTPS to the WAF-protected public load balancer, which uses the TLS 1.3/1.2 FIPS policy and forwards to private application targets. Aurora and S3 protect stored customer data with customer-managed keys. Customer-directed workflow email sent through Amazon SES can carry customer content to entity members or to addresses that the customer sets. GitHub Actions publishes release images to Amazon ECR through an authorized role. A reviewed public-data workflow delivers non-CUI data one way into an ingest bucket. Vanta reads configuration through a read-only audit role. In-boundary collectors send approved compliance evidence to Paramify. Lambda forwarders send operational alert metadata to Slack through AWS Network Firewall.",
	"x-cryptographicModules": [
		{
			"module": "AWS-LC / s2n, FIPS mode",
			"cmvpCertificate": "4816",
			"use": "TLS 1.2 and 1.3 at AWS service endpoints and load balancers"
		},
		{
			"module": "OpenSSL 3.1.2 FIPS Provider",
			"cmvpCertificate": "4985",
			"use": "TLS from the application containers"
		},
		{
			"module": "AWS Key Management Service HSM (GovCloud)",
			"cmvpCertificate": "4884",
			"use": "Encryption keys for data at rest"
		}
	],
	"x-nextQuarterlyReviewDate": "2026-12-02",
	"x-assessmentSummary": "A-LIGN (FedRAMP assessor ID 138665) is performing the independent assessment under SOW CON-011035. The 20x Class C assessment started on 2026-09-08 and is in progress. The overall assessment summary will be added when A-LIGN issues it."
}