VulcanGov Trust Center
FedRAMP ID FR2619254906 · Overview revised 2026-10-28 ·
Next scheduled progress update 2026-11-15
VulcanGov (Justinian for Government) combines an AI workspace, a legal and policy data library, isolated agent sandboxes, and agency administration. The scope below identifies the features included in this government offering and their deployment restrictions.
FedRAMP 20x Class C (Moderate) certification requested. Independent assessment completed by A-LIGN on September 11, 2026; application filed September 14, 2026. FedRAMP confirmed placement in its review queue on October 6, 2026; the package passed intake on October 15, 2026, and FedRAMP named the review team on October 27, 2026. Legacy FedRAMP Ready designation: June 10, 2026. No FedRAMP 20x certification decision or agency Authorization to Operate has been issued for VulcanGov.
All in-scope services are categorized Moderate. FedRAMP 20x certification is pending FedRAMP review.
Assessment conclusions are dated September 11, 2026; the application and provider filing follow-up are dated September 14, 2026. Each supporting artifact carries its own date and version.
Open agency portal Check assessment scope Marketplace record
Public resources open without signing in. For gated resources, first sign in to the agency portal, then use the artifact links below. The authenticated catalog supplies artifact dates, formats and SHA-256 hashes; the API documentation explains automated retrieval.
| Resource | Purpose and access | Open |
|---|---|---|
| Start here | One page: what is where, what changed since filing, and the open items with their dates. Agency sign-in | Start here |
| Offering and assessment scope | Service description, third-party resources, status and in-scope features. Public | Overview CPO JSON Scope JSON |
| Secure configuration | Deployment restrictions and recommended agency settings. Public | Guide Guide JSON |
| Availability | Measured service availability and incident history. Public | Status page Status JSON |
| Security Decision Record | Provider decisions, rule and KSI status, and supporting evidence references. Agency sign-in | SDR (human-readable) SDR JSON |
| Independent assessment | A-LIGN report and per-rule testing export from the September 11, 2026 assessment. Agency sign-in | Assessment PDF Testing export JSON |
| Ongoing reporting readiness | OCR dry-run for June 10 through September 11, 2026; not a filed ongoing certification report. Agency sign-in | Dry-run (human-readable) Dry-run JSON |
| What changed since filing | Changes to the package and the offering since the September 14, 2026 filing, with the record for each. Agency sign-in | Change history |
| Complete evidence catalog | Additional certification artifacts, including policies, KSI history and vulnerability evaluation records. Agency sign-in; API instructions public | Agency portal Catalog JSON API instructions |
All information on this page is generated from a single source and published in both formats (FedRAMP rule CDS-CSO-CBF). The JSON validates against the FedRAMP Certification Package Overview schema (2026-06-24).
pub.json — public offering data services.json — in-scope service list status.json — live availability
| FedRAMP ID | FR2619254906 |
|---|---|
| Provider | Vulcan Technologies, Inc. |
| Service | VulcanGov (Justinian for Government) (VulcanGov) |
| Certification type | FedRAMP 20x |
| Service model | SaaS |
| Deployment model | Government-Only Cloud |
| Business category | Legal & Policy, Artificial Intelligence (AI) |
| UEI number | K6R1PJDRE6P8 |
| Product website | https://vulcan.ai/fedramp |
| Product logo | https://trust.vulcangov.app/assets/logo.svg |
| Marketplace listing | https://www.fedramp.gov/marketplace/products/FR2619254906/ |
| Certification status | FedRAMP 20x Class C (Moderate) certification requested. Independent assessment completed by A-LIGN on September 11, 2026; application filed September 14, 2026. FedRAMP confirmed placement in its review queue on October 6, 2026; the package passed intake on October 15, 2026, and FedRAMP named the review team on October 27, 2026. Legacy FedRAMP Ready designation: June 10, 2026. No FedRAMP 20x certification decision or agency Authorization to Operate has been issued for VulcanGov. |
| Independent assessor | A-LIGN Compliance and Security, Inc. dba A-LIGN (FedRAMP Recognized independent assessor, ID 138665) |
| Independent assessment summary | A-LIGN (FedRAMP Recognized independent assessor; lead assessor Dennis Coats) completed the initial FedRAMP 20x Class C (Moderate) independent assessment of VulcanGov on September 11, 2026. All 203 applicable FedRAMP Consolidated Rules were assessed: 202 were found implemented and 1 gap was identified — FRC-APP-AFC, the FedRAMP Certification Application Form, which had not yet been filed at the assessment date. Provider follow-up: the application was filed September 14, 2026 (ticket 67477), and the provider recorded closure in SDR v48. This follow-up does not change the assessor's September 11 findings. All 46 Key Security Indicators were determined to be implemented and to meet the Class C bar of at least two automated validation methods per KSI. The six-month KSI validation history continues to accrue under the initial-certification arrangement. The assessor's report and control-testing export are available to agencies through the Trust Center portal. |
| Certification data status | The FedRAMP 20x Class C (Moderate) application was filed September 14, 2026 (ticket 67477). On October 6, 2026, FedRAMP placed the application in its review queue; it passed intake on October 15, 2026, and on October 27, 2026 FedRAMP named the review team and said the review would start soon. A-LIGN completed the independent assessment September 11, 2026. Ongoing certification report dates will be published upon certification; the available OCR dry-run is a readiness example, not a filed ongoing report. The Security Decision Record and assessment materials are available through the agency portal. |
| Certification track | This package supports the application for FedRAMP 20x / Program / Class C (Moderate). At the provider's request, the Marketplace listing retains the Legacy FedRAMP Ready designation (June 10, 2026) while the 20x Class C application is under review. |
| Service description | VulcanGov (Justinian for Government) is a SaaS AI platform for government: an AI agent workspace grounded in a curated, continuously updated library of federal and state statutes, regulations, guidance and housing datasets, with full-text and semantic search, secure single-use agent sandboxes for code execution and document generation, and an administration console for agency user management, session audit visibility and usage export. It is delivered from a government-only environment in AWS GovCloud (US) (us-gov-east-1) on a containerized microservices architecture: AWS ECS Fargate, Aurora PostgreSQL, S3 object storage, OpenSearch and ElastiCache. Federal customer data is stored and processed in AWS GovCloud (US); large language model inference is provided by Amazon Bedrock through a documented transport bridge, and every cross-boundary resource, including any temporary deviation, is disclosed in the published third-party information resources and service-scope lists rather than omitted. Data is encrypted at rest (AWS KMS, AES-256) and in transit (TLS 1.2/1.3) with FIPS 140-validated cryptographic modules; identity and access are federated through Okta for Government with enforced multi-factor authentication; security monitoring uses Datadog for Government, Wiz for Government and native AWS security services. Available to federal, state and local governments and to organizations working on their behalf. Public offering information, the secure configuration guide and live availability status are published on the Trust Center at https://trust.vulcangov.app; FedRAMP Certification Data is available to federal reviewers through its gated portal. |
| Independent assessment status | supplied · supplied 2026-09-11 · Overall summary of the FedRAMP independent assessment (IVV-IAS-OSA) as reflected in the assessor's report cover summary; the assessor's full report and per-rule testing export are published as gated-tier artifacts (independent-assessment class) following the CISO's first-publication review (CDS-CSO-RIS) on 2026-09-11. |
| Ongoing certification report recurrence | Ongoing Certification Report: the 15th day of the middle month of each calendar quarter (February, May, August, November), or the next business day when the 15th falls on a weekend or federal holiday; synchronous Quarterly Review: second Wednesday after each report publication (selected by the CISO 2026-08-25, replacing the quarter-end anchor selected 2026-08-23; first cycle contingent on certification). |
| Trust center repository | Trust Center, Public Offering Information · https://trust.vulcangov.app · VulcanGov FedRAMP Trust Center: public offering information (human-readable and JSON), in-scope service list, certification progress, and live availability status (status.vulcangov.app). Federal agency access to full FedRAMP Certification Data is provided through the gated portal. |
| Secure configuration guidance repository | Secure Configuration Guidance · https://trust.vulcangov.app/scg.html · VulcanGov Secure Configuration Guide, public — human-readable at /scg.html, machine-readable JSON at /scg.json, generated from the same source (CDS-CSO-CBF). No authentication or access request required. |
| Secure Configuration Guide | /scg.html · scg.json (public, no access request required) |
| Vulnerability disclosure | /security.html · report to security@vulcan.ai |
| Security contact | VulcanGov Security (CISO office) · security@vulcan.ai |
| Sales contact | VulcanGov Sales · sales@vulcan.ai |
Vulcan Technologies is pursuing FedRAMP 20x Class C (Moderate) Certification for VulcanGov, our AI platform for government, operated in AWS GovCloud (US). We publish our progress here and update it at least quarterly.
| Service | Description | Available since |
|---|---|---|
| VulcanGov AI Workspace | Conversational AI and long-running agent sessions, including file uploads for AI-assisted analysis and Office-compatible document collaboration. File uploads are in the assessed scope; deployment restrictions and required administrative grants are described in the Secure Configuration Guide. | 2026-06-23 |
| VulcanGov Data Library | Curated legal, regulatory, legislative, and housing datasets with full-text and semantic search, kept current by automated synchronization. | 2026-06-23 |
| Secure Agent Sandboxes | Isolated, single-use execution environments that support agent sessions (code execution, document generation). | 2026-06-23 |
| Administration Console | Organization and user management, session audit visibility, and usage export for agency administrators. | 2026-06-23 |
This list is complete: a service or feature not listed as in scope is not part of the FedRAMP Minimum Assessment Scope for VulcanGov. Service names match our public marketing materials. Any temporary deviation is disclosed here and in pub.json's third-party resources rather than omitted.
| Service | Security category | Included features |
|---|---|---|
| VulcanGov AI Workspace | Moderate | AI chat; Agent sessions; File uploads (in assessed scope; deployment restrictions and administrative grants are described in the Secure Configuration Guide); Document collaboration (Office-compatible editing); Managed web search; Managed web fetch (U.S. government and military domains only, GET-only; fetched sites are non-certified third parties, see the R24 record) |
| VulcanGov Data Library | Moderate | Legal & regulatory corpus; Legislative data; Housing & urban development datasets; Full-text and semantic search |
| Secure Agent Sandboxes | Moderate | Isolated code execution; Document generation |
| Administration Console | Moderate | Organization & user management; Session audit visibility; Usage export |
| Service / feature | Status |
|---|---|
| None — every platform service listed above is in scope. | |
| FedRAMP ID | Resource and use case |
|---|---|
| F1603047866 | AWS GovCloud (US), FedRAMP High. Infrastructure hosting: VulcanGov infrastructure and federal customer data reside in AWS GovCloud (US), apart from the disclosed cross-boundary resources listed here. |
| AGENCYAMAZONEW | AWS US East/West, FedRAMP Moderate. AWS Bedrock-powered model inference for the platform's AI features through US cross-region inference profiles that route only to us-east-1, us-east-2 and us-west-2, reached only through the platform's documented transport bridge. Bedrock receives user prompts and the content supplied with them and returns model output; model invocation logging is not enabled in the bridge account, so prompts and outputs are not retained there. |
| AGENCYAMAZONEW | AWS US East/West, FedRAMP Moderate. Amazon Bedrock AgentCore managed web search (AgentCore Web Search Tool), reached only through the platform's documented transport bridge. |
| FR2023864279A | Datadog for Government, FedRAMP High. Monitoring, logging and application telemetry. |
| FR2131856836 | Okta for Government High (Okta IDaaS Government High Cloud), FedRAMP High. Identity and single sign-on for VulcanGov users. |
| FR2308034636A | Wiz for U.S. Government, FedRAMP High. Cloud security posture management and agentless vulnerability scanning of the VulcanGov AWS GovCloud (US) environment. |
| Resource | Provider | Use case |
|---|---|---|
| None — every third-party information resource is FedRAMP-certified. | ||
Current and historical availability of core services (30-day measured window) and the full incident history since monitoring began are published at status.vulcangov.app in human-readable and machine-readable formats, hosted independently of the primary service (CDS-CSO-AVR).
Availability measurements began August 16, 2026. The status page shows the measured history, any no-data periods and the full incident history; dates before monitoring began are not backfilled.
The public tier requires no authentication. Federal agency users obtain FedRAMP Certification Data through the gated portal at https://trust.vulcangov.app/portal: enter a .gov or .mil email address, receive a one-time code by email, and download artifacts for 12 hours; no approval step and no provider action is required. Programmatic access (artifact index and downloads with the session token) is documented at https://trust.vulcangov.app/portal/api-docs. Parties without a .gov/.mil address (for example contractors acting on behalf of an agency) may request access by emailing security@vulcan.ai from their organizational address.
Open the gated portal · API documentation (programmatic access)
Certification Package Overview metadata (CPO-CSO-MTD): accountable official Jonah Calvo, Chief Information Security Officer, Vulcan Technologies, Inc., jonah@vulcan.ai · version 2026-10-28+85077f39e691 · last updated 2026-10-28T15:41:21+00:00 · source revision 85077f39e691 (also stamped in pub.json documentMetadata at build) · source of update: Generated by generator/build.py from source/trust-center.source.json. This revision: application queue status, Marketplace designation note, reviewer navigation, Security Inbox address in the access instructions, and third-party resource identifiers.
