Security & Compliance

Government-grade protection for the data you can't afford to lose.

Every pursuit you run through GovHub carries your proprietary strategy, your pricing logic, and your customer's requirements. That data sits on infrastructure built and continuously monitored against the same frameworks your own customers hold you to. Plain English first. Full technical detail below. Nothing on this page is rounded up — including the parts we haven't finished.

Your data is never used to train AI models — not by us, not by our providers.
Continuous Assurance

Monitored continuously, not annually.

A certification is a photograph. It tells you what was true on the day the auditor visited. Between visits, the honest answer for most vendors is that nobody is looking.

Our production AWS environment is monitored continuously by Orca Security for configuration drift, vulnerability exposure, and cloud misconfiguration — alongside AWS GuardDuty, Security Hub, Config, and CloudTrail. Orca measures our environment against the control catalogs behind SOC 2, ISO 27001, NIST 800-171, FedRAMP, and CMMC Level 2. Findings are reviewed on a defined cadence and tracked to remediation, or documented as accepted exceptions with business justification.

This is the part of our security posture we're most willing to be judged on today, because it's the part that's true every day rather than one day a year. It is also, precisely, a continuous posture assessment — not a certification or authorization of GovHub OnDemand. Our monitoring vendor has confirmed directly that its coverage does not extend to administrative controls such as HR checks, training, or written policy; those are addressed by our own security program.

Continuous
Not a point-in-time snapshot.
Five catalogs
SOC 2 · ISO 27001 · NIST 800-171 · FedRAMP · CMMC Level 2.
Acted on
Findings reviewed on a defined cadence and tracked to remediation.
Scored
Current posture scores are included in our security package, with the context they need.
Infrastructure Foundation

Built on infrastructure that is already authorized.

GovHub runs on Amazon Web Services in United States regions — us-east-1 as the primary production region, with us-west-2 for disaster recovery and file replication. AWS infrastructure holds FedRAMP authorization, SOC audit reports, and ISO 27001 certification, which means the physical security, network architecture, and hypervisor layer beneath GovHub are controls we inherit rather than reinvent.

GovHub does not operate in AWS GovCloud. All workloads run in standard AWS commercial regions within the United States. We state that explicitly because the distinction matters to federal buyers and we won't leave it ambiguous.

Here is the line most vendors blur: infrastructure certifications cover the infrastructure. They do not transfer to the application running on top. AWS certifies AWS. Amerix certifies Amerix — separately, on its own audit clock, and as the operator of the service Amerix is the party that will hold those certifications. What inheritance actually buys is a smaller and faster scope for our own. It buys us a head start. It does not buy us a badge.

Customer inputs and outputs processed through Amazon Bedrock are not used to train foundation models, are not shared with model providers, and are not retained after inference completes.Primary AI inference runs on Amazon Bedrock. Your win themes, your pricing strategy, your teaming logic, and your customer's requirements do not become training data for anyone — and that commitment is backed by Amazon's own service commitments, not only by our promise. One qualifier we'd rather state than bury: optional features such as image generation, voice, maps, and diagram rendering use non-AWS providers when you enable them, and can be disabled on request.
Technical Detail

For your security reviewer.

The section you forward. Expand what you need — including the four places we tell you what isn't finished.

In transit: all customer web and API traffic uses HTTPS with TLS 1.2 or higher. Production endpoints are HTTPS-only with HSTS, database connections require SSL, the cache is encrypted in transit, and connections to AWS services including Amazon Bedrock use encrypted AWS APIs.
  • At rest: customer files, deliverables, and the application database are encrypted with AWS KMS customer-managed keys, with automatic rotation enabled.
  • Application secrets — database credentials, API keys, token signing keys — are held in AWS Secrets Manager and rotate every 90 days. They are never stored in source code.
  • Audit logs and backups are encrypted with the same customer-managed keys.
  • Passwords are stored as irreversible hashes. Plaintext is never stored, and passwords, one-time codes, and tokens are never written to logs.
On FIPS 140, plainly: we employ strong, industry-standard cryptography, but we do not currently call AWS FIPS-validated endpoints, so we make no FIPS 140 claim. If your contract requires FIPS-validated cryptographic modules, raise it during evaluation — it is a configuration matter rather than an architectural one, and we'd rather discuss it before you sign than after.
GovHub OnDemand is a logically multi-tenant platform, and every account's data is separated by account identity.
  • Database records for pursuits, company profiles, agent outputs, and billing are scoped to the owning account.
  • Server-side authorization checks scope every API request to its owning account — one customer cannot read another customer's work through the API.
  • Uploaded files and generated deliverables are stored under account-specific paths.
  • AI processing for a pursuit runs only in the context of that account's own data.
GovHub accepts solicitation packages and company materials from external organizations as its core function, so this matters more here than it would for most platforms.
  • Files uploaded to our storage are scanned for malware by AWS GuardDuty Malware Protection, in both production and staging, with scan results tagged on each file.
  • GuardDuty Malware Protection is additionally enabled for account-level threat detection and disk-level malware checks.
  • Container images are scanned automatically on every push, and the deployment pipeline blocks any build containing a CRITICAL vulnerability.
Sign-in is available by email and password, email one-time passcode, Google single sign-on, or Microsoft single sign-on. Sessions use short-lived access tokens (15 minutes) with longer refresh tokens (7 days), and authentication endpoints are rate-limited with account lockout after repeated failures.
  • Multifactor authentication and single sign-on are required for all human access to the production AWS account.
  • Production services run under IAM roles with least-privilege permissions and no long-lived credentials.
  • The production database is not reachable from the public internet.
  • Security headers include HSTS, X-Frame-Options, Content-Security-Policy, and X-Content-Type-Options.
  • Failed logins and related security events are recorded for investigation.
On in-product MFA, plainly: GovHub does not yet offer built-in authenticator-app or hardware-key MFA for password sign-in. Email one-time passcode acts as a genuine second factor in OTP-based flows, and if you use Google or Microsoft single sign-on, MFA is enforced by your own identity provider. If your organization requires enforced MFA today, SSO through your own provider is the path that meets it. Built-in MFA is on the roadmap.
  • Three-tier private network design: a public edge for load balancers, a private tier for application containers with no direct internet access, and an isolated data tier — across two availability zones.
  • HTTPS-only load balancer fronted by AWS WAF running the OWASP Core Rule Set.
  • Encrypted PostgreSQL, multi-AZ for high availability, SSL required, not publicly reachable.
  • Encrypted object storage with public access blocked; CloudFront for media delivery.
  • Multi-region AWS CloudTrail with log file validation, 365-day audit log retention, and 90-day VPC flow logs.
  • Amazon GuardDuty, AWS Security Hub, and AWS Config, with HIGH and CRITICAL findings triggering real-time alerts.
Every change to production travels the same gated path.
  • All code lives in version control behind a protected main branch, and every change requires pull-request review before merge.
  • Automated tests and security scanning run on every build; a CRITICAL vulnerability blocks the deployment.
  • Infrastructure is managed as code, with every plan reviewed before it is applied.
  • Production deployments require manual approval from two reviewers.
  • Container images carry immutable commit-based tags, so any deployed artifact traces back to its exact source.
  • Deployments are rolling with health checks; rollback is immediate because previous images are retained.
  • Pipeline authentication uses federated identity — no long-lived cloud access keys are stored in the build system.
Your run history and deliverables are retained while your account is active, so you keep access to earlier work. Audit logs are retained 365 days, network flow logs 90 days, and database backups 30 days.
What account closure actually does today: it disables the account and blocks sign-in. The underlying data is retained for audit, legal, and recovery purposes. A complete data-erasure process is in development, and until it exists we will not promise deletion on request — we'd rather under-commit here than tell you something your own auditor could disprove. If you have a contractual erasure requirement, raise it with us before you buy and we'll tell you honestly where we stand.
Your pursuit data is not used to train AI models. This holds at both layers: Amerix does not train models on customer content, and primary AI inference runs on Amazon Bedrock, whose service commitments bar customer inputs and outputs from being used to train foundation models, shared with model providers, or retained after inference completes.
  • Automated database backups with point-in-time recovery across a 30-day window.
  • Daily encrypted backups to a separate, dedicated AWS Backup vault.
  • File versioning plus replication to a second US region.
  • Multi-AZ database with automatic failover; application containers auto-heal across availability zones.
What we won't publish yet: recovery time and recovery point objectives. We maintain internal engineering design targets, but formal restore testing is not complete — so those figures are targets rather than validated commitments, and we will not publish a recovery objective we have not proven.
The third parties that may process customer or account data:
Core — customer content
Amazon Web ServicesHosting, storage, encryption, logging, threat detection, backups
Amazon BedrockAI inference — does not retain content after inference or use it for training
Orca SecurityContinuous cloud posture monitoring — configuration findings only, not your pursuit content
Identity, email, payments
GoogleOptional single sign-on
MicrosoftOptional single sign-on and transactional email
StripeBilling and subscriptions — no pursuit content
Product and support
IntercomSupport and product messaging
FormbricksIn-product surveys
Optional features — only if you enable them
FAL.ai / Google GeminiImage generation
ElevenLabsVoice features
MapboxMap graphics
mermaid.inkDiagram rendering
Public research sources
Public data onlySAM.gov, GSA CALC+, FPDS / USAspending, Bureau of Labor Statistics and similar
Security-relevant events are logged across the application and cloud platforms. GuardDuty and Security Hub generate alerts to the operations team, and Orca surfaces misconfiguration and vulnerability findings for remediation. HIGH and CRITICAL findings alert in real time.
  • What would trigger notifying you: confirmed unauthorized access to your data, or a confirmed breach of tenant isolation.
  • Responsible disclosure: if you discover a vulnerability, report it to support@amerix.ai. We acknowledge within two business days and prioritize remediation by severity. We will not pursue action against researchers acting in good faith who avoid privacy violations and service disruption and give us reasonable time to remediate.
  • Remediation targets: CRITICAL in 7 days, HIGH in 30, MEDIUM in 90.
What we won't publish yet: a formal notification timeline. Our incident response plan is adopted, but the published customer commitment is pending final legal review. An SLA without an approved policy behind it is a number that fails on the one day it matters. It will be published here when it's real.
Data Handling

What GovHub is not built to hold.

Two rules, stated plainly because your compliance officer will ask.

Never upload classified information.
Not at any level, not in any form, not in a redacted excerpt. GovHub is a commercial cloud platform and is not accredited for classified material.
Treat CUI as your compliance officer's call.
GovHub has not undergone CMMC Level 2 certification and is not a CUI-scoped environment. If your pursuit involves Controlled Unclassified Information, route that question through your own compliance authority before it reaches our platform.

Everything else — solicitations, your own proposal content, your capability library, your win history, your pricing strategy — is exactly what the platform is built to handle.

Common Questions

The questions reviewers actually ask.

No. GovHub runs on FedRAMP-authorized AWS infrastructure in US regions and inherits controls from it — but the platform itself does not hold its own Authority to Operate, and we don't claim one. FedRAMP status is verifiable on the FedRAMP Marketplace; we'd rather you check.
Not yet. Our controls are aligned to the Trust Services Criteria and continuously monitored, but there is no SOC 2 Type II attestation and no audit currently underway. It is the next certification we pursue, and it will be held by Amerix.AI as the operator of the service. The day it's complete, this page changes and the badge appears here.
No. Amerix does not train models on customer content, and primary AI inference runs on Amazon Bedrock, whose service commitments bar customer inputs and outputs from being used to train foundation models, shared with model providers, or retained after inference completes.
Not today, and we'd rather say so plainly. GovHub is a commercial platform and has not undergone CMMC Level 2 certification. Classified material must never be uploaded under any circumstance. For CUI, your compliance officer makes that call — not our sales page.
In United States AWS regions — us-east-1 as the primary production region, with us-west-2 used for disaster recovery and file replication. AI inference runs on Amazon Bedrock in AWS. GovHub does not operate in AWS GovCloud; all workloads run in standard AWS commercial regions within the United States. One honest qualifier: optional features — image generation, voice, maps, and diagram rendering — use non-AWS providers if you enable them, and can be disabled on request.
Yes. Files uploaded to our storage are scanned by AWS GuardDuty Malware Protection, in production and staging, with scan results tagged on each file.
Not fully, and we won't pretend otherwise. Closing an account today disables it and blocks sign-in; the underlying data is retained for audit, legal, and recovery purposes. A complete data-erasure process is in development, and we will not commit to deletion on request until it exists. If you have a contractual erasure requirement, raise it before you buy.
Not yet. Third-party penetration testing is on our roadmap and has not been performed. We run continuous vulnerability scanning on container images and infrastructure code with defined remediation targets, but that is not the same thing and we won't present it as such.
We notify you directly on confirmed unauthorized access to your data or a confirmed breach of tenant isolation. We have not published a notification timeline yet — the formal commitment is in legal review, and an SLA without an approved policy behind it is worth nothing on the day it matters.
Send us your security questionnaire.
Most vendors treat a security review as an obstacle. We treat it as the shortest path to a serious conversation. Request our security package — control mappings, current posture scores, subprocessor detail, and our position on every framework above — and we'll return it with a named human on the thread.
Request the security package
We respond within two business days.