Security you can audit.
We handle sensitive federal contracting data. Security isn't an afterthought — it's built into every layer of the platform.
Where we stand on the frameworks that matter.
SOC 2 Type II
A SOC 2 Type II audit covering Security, Availability, and Confidentiality is in preparation — controls are mapped to the Trust Services Criteria, but an independent CPA firm has not yet been engaged. Report available to Enterprise customers under NDA on completion.
NIST 800-171
Controls mapped to NIST SP 800-171 for protecting Controlled Unclassified Information (CUI), including automatic redaction of sensitive identifiers before any third-party AI call (3.1.3), per-tenant access enforcement, and continuous-monitoring alerting. Formal assessment not yet undertaken.
FedRAMP 20x
We are pursuing FedRAMP 20x (Low first). VETR runs in AWS GovCloud (us-gov-west-1) with all 46 Key Security Indicators mapped, an OSCAL System Security Plan, and continuous monitoring live (AWS Config + Security Hub + GuardDuty) — and we are preparing to engage an accredited 3PAO for the independent assessment. VETR is not yet FedRAMP-authorized.
CMMC Level 2
Security controls aligned with CMMC Level 2 practices for organizations handling CUI in the defense industrial base.
Section 508
WCAG 2.1 Level AA: automated checks (axe-core runtime + ESLint jsx-a11y) report 0 violations across public and authenticated pages. Automated tooling catches only part of WCAG — no independent manual or assistive-technology audit has been performed yet. A VPAT/ACR is maintained and available on request.
Section 889
We maintain a review process for covered-telecommunications restrictions and supply-chain representations relevant to the platform environment. Detailed certifications available on request.
Six layers, one defense in depth.
The specifics, organized by category — every control reviewable, exportable, audit-ready.
01
Data Protection
- AES-256 encryption at rest — database, object storage, and cache
- TLS 1.3 offered on every endpoint, with TLS 1.2 as the enforced minimum
- Encrypted automated backups with point-in-time recovery, replicated across Availability Zones
- Strict per-organization data isolation — every query is tenant-scoped
02
CUI Safeguards
- Automatic CUI/PII redaction (SSN, EIN, financial, classification markings) before any text reaches a third-party AI model
- Raw model output and extracted document text are kept out of application logs
- AI-assisted CUI scanner with human-in-the-loop review for proposals
- Practices mapped to NIST SP 800-171 controls for protecting CUI
03
Access Control
- Enforced multi-factor enrollment for privileged roles; TOTP two-factor available to every user
- Role-based access control — read-only roles cannot mutate data
- 12-character, breach-checked passwords with brute-force lockout
- Single Sign-On (SSO) via SAML 2.0 — Enterprise
04
Application Security
- SSRF protection — outbound/webhook requests are blocked from reaching internal or metadata endpoints
- Signature-verified inbound webhooks (payments, e-signature)
- Output sanitization against stored-XSS (HTML) and spreadsheet formula injection (CSV exports)
- Content-type-verified uploads with optional malware scanning
05
Infrastructure
- AWS GovCloud, multi-AZ, with deploy circuit-breaker and auto-rollback (a 99.9% uptime SLA is available under an Enterprise agreement)
- Automated security patching
- DDoS protection via AWS Shield Standard
- AWS WAF deployed in front of the application
06
Monitoring & Response
- 24/7 infrastructure monitoring
- Real-time intrusion detection
- Automated anomaly alerting
- Documented incident-response plan (target initial response < 4 hr)
07
Development
- Security review on changes touching authentication, tenant isolation, or customer data
- Dependency and container vulnerability scanning that fails the build on HIGH/CRITICAL findings
- Third-party penetration testing (planned with 3PAO assessment)
- Infrastructure-as-code scanning (Checkov) and a cross-tenant isolation test suite in CI
08
Audit & Privacy
- Comprehensive audit logging
- Append-only audit logs (WORM/object-lock archival in progress)
- Data retention and deletion controls
- Privacy-by-design architecture
Where we are on the FedRAMP path — milestone by milestone.
We publish our security roadmap because veteran-owned contractors deserve transparency, not vague compliance theater. Update cadence: quarterly.
Phase 1 — Foundation (Complete)
Complete- AES-256 at rest, TLS 1.3 available with TLS 1.2 minimum in transit
- AWS multi-AZ deployment
- Append-only audit logging enforced at the model layer (WORM / object-lock archival in progress)
- CUI redaction service shipped
Phase 2 — NIST 800-171 self-attestation documented (gaps tracked in POA&M)
Complete- 110-control NIST SP 800-171 r2 mapping documented
- POA&M (Plan of Action and Milestones) maintained
- CMMC L2 alignment review complete
Phase 3 — SOC 2 Type II audit (in preparation, not yet certified)
In progress- Preparing to engage an independent CPA firm; observation window not yet started
- Type II report to follow the observation window
- Available to Enterprise customers under NDA on completion
Phase 4 — FedRAMP 20x assessment (in preparation, not yet authorized)
In progress- Preparing to engage an accredited 3PAO for the independent assessment + penetration test
- OSCAL System Security Plan + Body-of-Evidence package prepared
- All 46 Key Security Indicators (KSIs) mapped; continuous monitoring live
Phase 5 — FedRAMP 20x authorization (planned, not yet authorized)
Planned- Independent 3PAO assessment → KSI validation → FedRAMP Marketplace listing
- Starting at 20x Low; Moderate to follow
- Built for veteran-owned / set-aside contractors handling CUI
Found a vulnerability? Tell us.
We acknowledge valid reports within 48 hours and work with researchers in good faith. No lawyers, no surprises.
Report to security@vetrproposal.com
The questions a security reviewer actually asks.
Answered plainly, including where we are not yet certified. A vendor who will not tell you what they have not achieved is not telling you much. Broader questions about the product are on the FAQ.
Does VETR send our proposal content to an external AI provider?
No. VETR runs on AWS GovCloud (us-gov-west-1) and its AI calls go to Amazon Bedrock inside that account. The boundary is enforced in code rather than by policy: a provider factory pins Bedrock and ignores any customer-supplied external API key, so an organisation cannot accidentally route content to a commercial model provider even if it wanted to. Embeddings follow the same binding. No proposal text, RFP document or organisation content egresses to a third-party AI service.
Where is our data stored, and in which region?
In AWS GovCloud (US), region us-gov-west-1. GovCloud is the AWS partition operated for US government workloads, with access restricted to screened US persons. Documents you upload are stored in-boundary, and the database, queue workers and AI inference all run in the same account.
Is VETR SOC 2 certified?
Not yet. SOC 2 Type II is in preparation with A-LIGN engaged as the assessor. We publish the current status of every framework on this page with what is complete, what is in progress and what is not yet authorised, rather than implying a certification that does not exist. A compliance summary packet is available to download.
Is VETR FedRAMP authorized?
No. VETR is preparing to engage with FedRAMP 20x and is not authorised. The platform runs in AWS GovCloud, which is FedRAMP High authorised as an infrastructure provider, but that authorisation belongs to AWS and does not transfer to software running on it. Any vendor implying otherwise is worth questioning closely.
How does VETR handle CUI and controlled documents?
Uploaded solicitations and proposal documents are treated as CUI-adjacent and kept in-boundary. VETR is aligned with NIST SP 800-171 and with CMMC Level 2 practices. Rich text is sanitised on save, uploads are scanned, and CUI redaction is available for documents that need it before sharing outside the organisation.
How is one organisation's data kept separate from another's?
Every tenant-scoped model carries a global query scope that filters to the signed-in user's organisation automatically, so isolation is the default behaviour of the data layer rather than something each query must remember to do. Bypassing it requires an explicit, reviewed exception. The mechanism was introduced after an internal audit found cross-tenant lookups, and it is covered by tests.
Do you support single sign-on and multi-factor authentication?
Yes. SAML SSO is available on Enterprise, and two-factor authentication is supported for all accounts. It is REQUIRED for organisation owners and platform administrators, enforced at the platform level. A per-organisation control letting a customer mandate 2FA for every member is on the roadmap and does not ship today — if your security questionnaire asks whether MFA can be enforced tenant-wide for all users, the honest answer today is not yet. Failed-login lockout is enforced in line with NIST AC-7.
Can we get security documentation for our review?
Yes. A compliance summary packet is downloadable from the trust centre, covering framework status, control families and the current posture. The full SIG or CAIQ answer set is available on request and is reviewed before release. If you need a specific artefact for a vendor assessment, ask and we will tell you honestly whether it exists yet.
Need our security package?
Enterprise customers get our NIST 800-171 control mapping, architecture review, and completed security questionnaires under NDA today — plus the SOC 2 report and pen-test summary as soon as those assessments complete.