GovEagle maintains the highest compliance and security standards to ensure any proprietary content shared with GovEagle is safe and secure. GovEagle is FedRAMP Moderate authorized and is under continuous monitoring to maintain these rigorous security standards.
CMMC Status (Handling CUI/CDI/FCI)
GovEagle is authorized at the FedRAMP Moderate impact level. The GovEagle cloud service offering is listed under the Knox Systems FedRAMP Moderate authorization (FedRAMP Package ID F1206111371) and operates as a segregated tenant environment inside that authorization boundary. The authorization became effective on July 31, 2026.
Here's what your team needs to know:
DoD guidance classifies any cloud service that modifies the basic cloud service as a cloud service provider (CSP). More specifically, GovEagle is a cloud service offering (CSO), as it manipulates and serves its offering on top of a CSP. Refer to the CMMC FAQ, Section E-Q1.
The CMMC requirement for a CSP or CSO handling CUI/CDI is FedRAMP Moderate authorization or FedRAMP Moderate equivalency. GovEagle meets the authorization branch of that requirement, which is the stronger of the two paths.
Because GovEagle is authorized, your organization does not need to make an independent equivalency determination or accept the residual risk of one. Authorization is verifiable through the FedRAMP package rather than something you assess yourself.
GovEagle is one system within your CUI environment. Inheriting our controls does not by itself satisfy your CMMC obligations. Our shared responsibility documentation identifies, objective by objective, what remains your responsibility to implement and evidence in your own environment.
A complete authorization package, covering the security plan, control implementations, boundary architecture, and shared responsibilities, is available for your security team's review. Contact security@goveagle.com to request it.
Highlighted Controls
Infrastructure Security
Hosted inside a FedRAMP Moderate authorized boundary, in AWS commercial US regions
Redundant infrastructure across multiple availability zones, with cross-region backup replication within the United States
Logical tenant isolation separating each customer organization's data and workspaces
Continuous security monitoring and threat detection
Encryption in transit using FIPS 140-validated cryptography, and AES-256 encryption at rest
Access Control
Role-based access control (RBAC) implementation
Mandatory multi-factor authentication (MFA)
Comprehensive audit logging
GovEagle Personnel Access to Customer Data
GovEagle does not browse customer content. Access by GovEagle personnel is technically possible but is constrained by the controls required under our FedRAMP authorization:
Access to the production environment requires a submitted and approved request, and every access event is captured in an audit trail.
Privileged access is limited, least-privilege, and separated between the platform operator and GovEagle, with duties divided between them.
Every individual with access to the authorization boundary is a U.S. person. Access requires U.S. citizenship, operation on U.S. soil, a completed background check, and current security awareness training before it is granted. This applies to both GovEagle personnel and the personnel of the cloud service provider operating the boundary.
Junior staff and general support personnel cannot independently reach customer data in production.
Web Search and External Retrieval
When the GovEagle agent needs information that is not present in your content library, it can retrieve information from the public web. This retrieval happens inside our authorized environment:
Web retrieval runs on Google's Gemini models through Vertex AI, within the Google Cloud Assured Workloads environment configured for FedRAMP Moderate that supports our authorization.
There is no separate third-party search vendor in the path. Queries are not sent to consumer search engines such as Google Search or Bing.
Retrieval is covered by our enterprise agreement with Google, under which query data is not tracked or used for advertising or model training.
Web search can be disabled per chat, per user, or at the organization level. See Chat Settings.
Security Assessments and Monitoring
FedRAMP Moderate authorization, effective July 31, 2026
Continuous monitoring under the FedRAMP program, including monthly vulnerability scanning across infrastructure, database, and web application layers
Findings tracked, prioritized, and remediated, with regular reporting to the agencies whose authorizations cover the boundary
Annual assessment by a FedRAMP-recognized Third-Party Assessment Organization
Continuous penetration testing and regular third-party security assessments
Documented incident response procedures, exercised through tabletop and functional testing
AI Training
GovEagle will not train any models on your data
Zero data retention terms with our model providers (Anthropic, Google): customer data is not retained after inference and is not used to train or improve any provider's models
Model inference runs through Google Cloud Vertex AI inside the authorized environment; no customer content is sent to model endpoints outside it
Ongoing Compliance and Monitoring
GovEagle maintains its security standards through the continuous monitoring program that the FedRAMP authorization requires.
Continuous Monitoring Program
Ongoing security control monitoring and assessment
Monthly vulnerability scanning and tracked remediation
Ongoing compliance validation against the FedRAMP Moderate control baseline
Annual security control assessment by a FedRAMP-recognized 3PAO
Frequently Asked Questions
What if I'm not comfortable with a full SharePoint integration?
Your team is encouraged to use GovEagle's document management workflow, in which administrators can scope and upload a limited amount of pre-approved content. All of GovEagle's above controls will still apply in this case.
Where is my data stored?
All data is stored inside the FedRAMP Moderate authorization boundary, in AWS commercial US regions within the United States, with redundancy across multiple availability zones and cross-region backup replication that also stays within the United States. Each customer organization's data is logically isolated to prevent any cross-tenant access. No service, data store, or backup resides outside the United States.
Does GovEagle send my prompts, documents, or search queries to public search engines?
No. When the agent retrieves information from the web, that retrieval runs on Google's Gemini models through Vertex AI inside the Google Cloud Assured Workloads environment configured for FedRAMP Moderate. There is no separate third-party search vendor in the path, and queries are not sent to consumer search engines such as Google Search or Bing. Query data is covered by our enterprise agreement with Google and is not tracked or used for advertising or model training. See Web Search and External Retrieval above for detail, and Chat Settings for how to disable web search.
Can GovEagle employees see our data?
GovEagle does not browse customer content. Access to the production environment is technically possible but requires an approved request and generates an audit trail, as required under our FedRAMP authorization. Privileged access is least-privilege and separated between the platform operator and GovEagle, and every individual with boundary access is a U.S. person who has completed a background check and current security training. Junior staff and general support personnel cannot independently reach customer data in production. See GovEagle Personnel Access to Customer Data above.
Can GovEagle handle CUI?
Yes. GovEagle is FedRAMP Moderate authorized, which is the compliance status CMMC requires of a cloud service provider handling CUI on a contractor's behalf, and the NIST 800-171 requirements are a subset of the NIST 800-53 controls behind that baseline. The authorization covers CUI at the Moderate impact level, including ITAR technical data. GovEagle is not authorized for classified information.
Is GovEagle "GCC High"?
No, and it does not need to be. GCC High is a Microsoft environment for Microsoft's own products, not an accreditation a third-party application can hold. The accreditation that governs a cloud service provider handling CUI on your behalf is FedRAMP Moderate authorization, which GovEagle holds. If your organization uses GCC High for Microsoft 365, GovEagle works with it: we support Commercial, GCC, and GCC High tenants for the SharePoint connector, the Office add-ins, and Teams chat, and your tenant stays under your control. See Connecting SharePoint to GovEagle and Deploying Microsoft Office Add-Ins.
What authentication methods are supported?
GovEagle requires multi-factor authentication (MFA) for all users and supports integration with various identity providers. See Login Credentials and Roles for detail.
How often are security assessments performed?
Vulnerability scanning runs monthly across the infrastructure, database, and web application layers, with findings tracked and remediated under the continuous monitoring program. A FedRAMP-recognized 3PAO assesses the security controls annually, and penetration testing runs continuously.
What happens if there's a security incident?
We maintain comprehensive incident response procedures and will notify affected customers according to our incident response plan and applicable regulations. Reporting obligations include DFARS 252.204-7012 72-hour cyber incident reporting to the DoD Cyber Crime Center (DC3) where applicable, and FedRAMP incident reporting to the agencies whose authorizations cover the boundary.
Will using GovEagle impact my CMMC audit?
No. GovEagle holds the FedRAMP Moderate authorization that CMMC requires of a CSP handling CUI, and we provide the authorization documentation your assessor needs, including our shared responsibility documentation showing which objectives we cover and which remain yours.
Does GovEagle offer an on-prem solution?
Yes. GovEagle can deploy our system to your hardware or cloud environment. These deployments sit outside the FedRAMP Moderate authorization boundary described above and are scoped and assessed separately. Please reach out if you'd like to discuss these options in further detail.
I'm still worried about CUI, what are my options?
We totally understand that processing CUI through GovEagle can be intimidating. Teams are more than welcome to refrain from uploading CUI into the platform until they've built full confidence.
How can I get more information?
Please reach out to security@goveagle.com for additional questions.