Trust centre
Security and compliance posture
This is a prototype. The page below states what a production deployment would be built to satisfy, and states plainly what is not claimed — because a compliance badge that overstates its scope is worse than none at all.
Current position
Cloud authorization
Not yet heldA production deployment would target Impact Level 2 under the DoD Cloud Computing Security Requirements Guide, which is commonly satisfied through reciprocity with a FedRAMP Moderate authorization. No authorization exists for this prototype.
FedRAMP
Not yet heldFedRAMP now issues a single label — FedRAMP Certification — with Classes A through D that describe assessment coverage and depth. Classes are not impact levels, and a FedRAMP status is not a government-wide authority to operate: each agency issues its own.
Section 508 / WCAG
Designed againstThe interface is built to WCAG 2.1 Level AA: a visible focus indicator on every control, full keyboard operation, a pause control for all motion, and a tabular equivalent beside every graphical view. A conformance report would be produced against a shipped release, not a prototype.
CMMC
Not assessedThe applicable level depends on whether a given engagement involves Federal Contract Information or Controlled Unclassified Information, and is set by the contracting officer. No assessment has been performed.
Data residency
Design commitmentA production deployment would hold all customer data, backups, disaster-recovery copies, logs and support records inside the United States, including anything held by infrastructure subprocessors.
Authentication
Design commitmentSingle sign-on through the agency identity provider over SAML 2.0 and OpenID Connect, with multi-factor enforced upstream and local accounts disabled.
What this prototype does not claim
- No FedRAMP authorization, certification or agency authority to operate exists for this software.
- No CMMC assessment has been performed and no level is asserted.
- No accessibility conformance report has been issued; the design intent above is not a substitute for one.
- Every organization, account, user, post, metric and service figure in the prototype is fabricated.
- Nothing in the prototype connects to a social platform, and no content can be published from it.
Accessibility approach
The canvas is never the only route
Three-dimensional views convey nothing the interface does not also present as a table on the same screen. A canvas exposes no structure to assistive technology, so anything conveyed only there would be unreachable.
Motion has a visible off switch
A pause control sits in the application chrome rather than buried in settings, and the operating system reduced-motion preference is honoured automatically. Pausing moving content is a Level A requirement.
Accessibility failures block release
A missing image description or an uncaptioned video stops submission rather than raising a warning, and the result is retained with the record so the question can be answered later from evidence.