Security
A tool that holds authorization data is part of the attack surface.
CertiField aligns its security program with NIST SP 800-171 and deploys in US Government cloud. Below is how the product handles your data, how it is built, and — where we do not yet hold an attestation — a straight answer rather than an implication.
- NIST SP 800-171 aligned
- US Government cloud
- TOTP 2FA
- Hash-chained audit
- Fail-closed uploads
- Ref
- S-01
- Kind
- Data handling
Data handling
| Area | Posture |
|---|---|
| Data residency | US Government cloud (GovCloud) regions. |
| Encryption | In transit and at rest, consistent with our NIST SP 800-171 alignment. Application-level encryption uses AES-GCM with a per-value nonce. |
| Access control | Role-based, least-privilege, evaluated from a single policy table rather than scattered checks. Authentication is default-on; a short, individually justified allowlist covers the endpoints that are not, each naming what authenticates it instead. |
| Authentication | TOTP two-factor with recovery codes. No SMS path. Password policy, history, minimum age and lockout follow DISA STIG requirements. |
| Session control | Short-lived access tokens, concurrent-session limits, and revocation that fails closed on locked or deleted accounts. |
| Audit trail | Hash-chained audit events covering data modification, privileged access and authentication, with chain integrity verified nightly. Secrets and sensitive payloads are deliberately excluded. |
| Uploads | Validated on magic bytes against a minimal per-surface extension list, malware-scanned fail-closed, and hashed server-side. The client-declared file type is treated as a claim to verify, never as a routing instruction. |
| Error handling | Responses are sanitized so database object names, file paths, connection strings and stack frames never reach a caller. The full error is logged internally with a correlation identifier. |
| Data retention and deletion | Contact us for current retention and deletion specifics. |
- Ref
- S-02
- Kind
- Hosting
Hosting and infrastructure
| Area | Posture |
|---|---|
| Environment | US Government cloud (GovCloud). |
| AI inference | Configurable per deployment: a hosted provider, a local OpenAI-compatible model on your own hardware, or disabled entirely. In the local and disabled configurations no prompt or credential leaves the environment. |
| Disconnected operation | DISA STIG catalog updates move by exported bundle rather than an outbound call, and those bundles carry applicability relevance profiles. |
| Deployment options | Government cloud deployment. Contact us to discuss other options. |
| Backup and availability | Contact us for current backup and availability details. |
- Ref
- S-03
- Kind
- Standards
Standards and compliance
| Standard | Status |
|---|---|
| NIST SP 800-171 | Security program aligned to the 800-171 control families for protecting Controlled Unclassified Information. |
| NIST RMF | RMF-native by design — authorization boundaries, 800-53 Rev 5 baselines, CCIs, STIGs, POA&M and authorization packages are first-class objects, not tags. |
| Development standards | Built against DISA STIG, OWASP secure coding practice, the OWASP Top 10, the SANS Top 25 and the NIST Secure Software Development Framework. |
| Supply chain | SBOM-compatible, with dependency vulnerability scanning in the build pipeline. |
| FedRAMP / DoD Impact Level | Contact us to discuss our current authorization status and roadmap. |
| SOC 2 and other attestations | Contact us for current status. |
We do not claim a FedRAMP authorization or a DoD Impact Level we do not hold. If either is a gate for your program, ask us directly and we will tell you where we are.
- Ref
- S-04
- Kind
- Assurance
How we build it.
Security requirements are build constraints rather than a review at the end. Authorization policy lives in one table so the whole policy is one diff a reviewer can read; a new endpoint with no entry in it fails the build rather than shipping ungated.
AI assists our engineering, and every change is reviewed, understood, tested and accepted by an engineer before merge — with heightened review for anything touching architecture, security, authentication, authorization or compliance logic.
Our AI-assisted development policy →Requesting our documentation
For our security documentation, a vendor questionnaire, or a conversation about authorization status, contact info@certifield.software.
Book a security briefNext step