Book a Demo
SECURITY OVERVIEW

Security and Compliance for Government Contractors

Procurement Sciences was founded by a government contracting veteran who understands that security isn't optional, it's operational. We've invested heavily in security infrastructure and a team of cybersecurity experts, FedRAMP assessors, and CMMC practitioners. Our platform was created to support federal contractors who handle CUI, work on critical DoD programs, and need AI that transforms operations while maintaining CMMC Level 2 and FedRAMP compliance.

New Project (9)
Architecture
Data Protection
Privacy & Security
Data Handling
Recognition
Operations
FAQ
ARCHITECTURE

Architecture Overview

The Awarded AI application operates on a single-tenant architecture for government procurement security. Each customer deployment is a data isolated instance with dedicated storage resources. Customer data is never commingled across deployments.

Secure Deployment Options for Government Contractors

We offer three deployment models to accommodate varying compliance and operational requirements: 

Azure Commercial Cloud

Hosted in US-based Microsoft Azure commercial data centers. Suitable for organizations requiring strong security controls without federal cloud mandates.

Azure Government Cloud

Hosted in dedicated US Government regions (Azure Government) that utilize FedRAMP High-authorized infrastructure controls. This environment is purpose-built to meet the compliance standards (including CUI and GCC High compatibility) required by federal contractors.

Customer-Managed

Deployed on customer-owned cloud infrastructure using Kubernetes-based architectures. Provides complete control over the environment for organizations with strict data residency or air-gapped requirements.

The Awarded AI application will soon obtain FedRAMP Moderate authorization.

DATA PROTECTION

Defense-Grade Data Protection & CUI Security

Encryption

All data is encrypted using AES-256 at rest. Data in transit is protected via TLS 1.2 or higher. Cryptographic implementations align with FIPS 140-2 validated modules.

Data Isolation

Each customer environment is logically separated. Network segmentation, dedicated storage accounts, and isolated compute resources prevent any cross-tenant data access.

Data Residency

All data is stored and processed within the United States. For Azure Government and self-hosted deployments, data remains within the specified compliance boundary.

Stateless LLM Inference

For cloud-hosted AI services (Azure OpenAI, Gemini on Vertex, Anthropic), we use API configurations where customer prompts and responses are not retained or used for model training.

Zero-Retention API Endpoints

We configure all AI service API endpoints with zero data retention policies. Customer prompts and AI responses are processed in real-time and are not stored, logged, or used for model training by AI service providers.

PRIVACY & SECURITY

Access Control

Authentication

We support integration with enterprise identity providers including Microsoft Entra ID (Azure AD) through OIDC, Okta, and other SAML 2.0 compliant systems. Multi-factor authentication is required for all user access.

Administrative Access

Procurement Sciences personnel access to customer environments is restricted and logged. Access reviews are conducted on a regular, documented schedule.

DATA HANDLING

Network Security

  • Perimeter Controls

All deployments include web application firewall (WAF) protection, DDoS mitigation, and intrusion detection capabilities provided through Azure-native security services.

  • Network Segmentation

Azure Virtual Network (VNet) configurations isolate customer traffic. Ingress and egress rules restrict communication to authorized endpoints only.

  • API Security

All API endpoints require authentication. Rate limiting and input validation protect against abuse and injection attacks.

RECOGNITION

Compliance & Certifications

If you’re looking for FedRAMP government contracting software, look no further. We have all of the certifications you need to work confidently in a CMMC complaint AI platform.

SOC 2 TYPE 2

CMMC Level 2 Assessed

FedRAMP Moderate Authorization
In-Progress

SOC 2 TYPE 2

CMMC Level 2 Assessed

FedRAMP Moderate Authorization
In-Progress

Azure Inherited Controls

Azure Commercial Cloud and Azure Government Cloud environments for contractors inherit compliance controls from Microsoft, including ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3, and FedRAMP High (Azure Gov).

OPERATIONS

Security Operations

Vulnerability Management

We conduct regular vulnerability scanning of infrastructure and applications. Third-party penetration testing is performed annually, with executive summary available upon request.

Commercial Cloud / Government Cloud

Learn More

Logging and Monitoring

Comprehensive audit logs capture user activity, data access, API interactions, and administrative actions. Logs are retained per customer requirements and are available upon request.

Fully isolated on portable hardware

Learn More

Incident Response

We maintain a documented incident response plan. Customers are notified of confirmed security incidents affecting their data within 72 hours of discovery, or sooner if required by contract.

Corporate Private Cloud / Direct to server

Learn More

Frequently Asked Questions

Is my data used to train AI models?

No. Customer data is never used to train AI models. Each deployment uses stateless (zero data retention) API configurations. This is an AI platform that doesn’t train on your data.

Can we use the Awarded AI application for CUI?

Yes. Our Azure Government deployment is designed to meet NIST 800-171 requirements for protecting CUI. We recommend discussing your specific compliance requirements with our team.

Do you support GCC High?

Yes. Our Azure Government deployment is compatible with GCC High environments, including GCC High SharePoint integration.

How do you handle AI hallucinations?

We provide source citations for queries against trusted data sources and customer documents. We also provide training on identifying and managing AI-generated content that requires verification.

Can we get audit logs?

Yes. Comprehensive audit logs are available upon request. For Azure Government and self-hosted deployments, customers can configure direct log access.

Additional Resources

  • SOC 2 Type II report
  • Penetration test executive summary
  • Completed security questionnaires (SIG, CAIQ, custom)
  • Architecture diagrams for your specific deployment model
  • Data Processing Agreement (DPA)

Procurement Sciences

Save time. Deliver faster. Win more.

Book a Demo
Book a Demo