Question 1

What is AutogenAI Federal?

Accepted Answer

AutogenAI Federal is the secure, closed-boundary architecture version of our AI proposalautomation platform, purpose-built for U.S. federal agencies and defense contractors.It operates in a FedRAMP® High authorized environment, meeting the most stringent U.S.government standards for data security, integrity, and control.The platform delivers the same AI-driven productivity and compliance advantages as our commercialversion but within a secure, government-trusted environment.

Question 2

What certifications and frameworks does AutogenAI Federal comply with?

Accepted Answer

AutogenAI Federal complies with the following authorisations, certifications and frameworks:FedRAMP® High authorizedCMMC Level 2 (CMMC 2.0)AutogenAI Federal is designed to support IL5 and IL6 deployments, leveraging a strategicpartnership with Palantir FedStart. This collaboration ensures that AutogenAI meets the rigoroussecurity and compliance standards required for government and defense sectors.DFARS cybersecurity and contracting requirementsITAR export-control regulationsNIST SP 800-53 Rev 5 and NIST SP 800-171 for CUI handlingFully approved for processing Controlled Unclassified Information (CUI)

Question 3

Where is data hosted?

Accepted Answer

All federal customer data is stored exclusively in the United States, hosted within Palantir’sFedRAMP® High authorized cloud on AWS GovCloud.No customer data ever leaves this boundary. The environment is fully isolated from commercialnetworks and Internet AI systems

Question 4

Does AutogenAI Federal use external AI APIs or Internet-based models?

Accepted Answer

No. The Federal platform does not connect to or rely on any Internet-facing AI models, APIs, or datasources. All AI model execution occurs within the FedRAMP® High environment, using models vettedand hosted inside the authorized boundary.

Question 5

Is this a multi-tenant or single-tenant architecture?

Accepted Answer

By default, AutogenAI Federal operates as a multi-tenant system inside a FedRAMP® High boundarywith strict logical isolation and zero data commingling.Single-tenant deployments may be available for agencies or primes requiring infrastructure-levelisolation, subject to agreement on contractual terms and pricing.

Question 6

How does AutogenAI handle Controlled Unclassified Information (CUI)?

Accepted Answer

AutogenAI Federal is explicitly designed to handle CUI in compliance with NIST 800-171 and CMMCLevel 2 controls.All access to CUI is encrypted, logged, and restricted to verified U.S. Persons. AutogenAI Federal isdesigned to support IL5 and IL6 deployments, leveraging a strategic partnership with PalantirFedStart. If deployed, data handling follows DoD IL5 and FedRAMP® High requirements forconfidentiality and integrity.

Question 7

Can AutogenAI integrate with GCC High environments?

Accepted Answer

Yes. AutogenAI Federal integrates with Microsoft GCC High, SharePoint GCC High, and SalesforceGovernment Cloud Plus. It provides Microsoft Office applications including Word, Excel, Outlook, anduser authentication in an environment authorized for both IL5 and FedRAMP® High use.Each integration requires review and approval by the customer’s security team. Our securityleadership team (Daniel Whitson and Emma Matsubara) supports these reviews to streamlineauthorization.

Question 8

Is AutogenAI compliant with ITAR regulations?

Accepted Answer

Yes. The platform is ITAR-compliant and restricted to U.S. Persons only.All infrastructure, administrative access, and data storage remain within the United States. Thisensures compliance with U.S. export control regulations.

Question 9

Who will have access to our data?

Accepted Answer

Access is strictly limited to cleared, U.S.-based personnel operating under role-based controls.All privileged and administrative access is logged, monitored, and reviewed under FedRAMP® HighAC-2 and AU-6 controls.No access is permitted for non-U.S. Persons or external vendors

Question 10

Is data encrypted in transit and at rest?

Accepted Answer

Yes.In Transit: Encrypted using TLS 1.2 or higher.At Rest: Encrypted using AES-256.Keys are managed under FIPS 140-3 validated modules in alignment with FedRAMP® and DoDencryption standards.

Question 11

What auditing and logging capabilities are in place?

Accepted Answer

AutogenAI Federal implements full auditing, logging, and retention aligned with FedRAMP® High AUcontrols. Logs are immutable, continuously monitored, and retained according to CMMC Level 2.Customers may request audit extracts or integrate their SIEM for real-time log monitoring.

Question 12

What incident response and breach notification policies are in place?

Accepted Answer

AutogenAI follows a FedRAMP® High-aligned incident response plan based on NIST 800-61 Rev 2.In the event of an incident, customers are notified within one hour of discovery in accordance withFedRAMP® and agency requirements.Response, remediation, and lessons-learned documentation are shared via secure channels.

Question 13

What third-party vendors or sub-processors are involved?

Accepted Answer

AutogenAI Federal only uses AI residing in the FedRAMP High System Boundary, with zero dataretention and no training or sharing of data.Independent audits are performed by Schellman.

Question 14

Can we conduct our own security review or penetration test?

Accepted Answer

Yes.AutogenAI supports third-party or agency-led penetration testing within approved testing windows.We also provide sanitized Schellman 3PAO audit reports post-ATO upon request.All custom tests must be coordinated with our Security Operations team to maintain authorizationboundaries

Question 15

What is the relationship between AutogenAI and Palantir FedStart?

Accepted Answer

AutogenAI Federal is hosted through the Palantir FedStart program, which accelerates andmaintains FedRAMP® High authorization.This partnership ensures continuous compliance, advanced audit readiness, and sharedinfrastructure resilience under the FedRAMP® High ATO boundary.

Question 16

How often is the system updated and reviewed?

Accepted Answer

AutogenAI Federal follows a continuous monitoring and quarterly review cycle.Updates are released in tandem with the commercial version but undergo additional change-controland security testing before deployment to maintain ATO compliance

Question 17

How does AutogenAI ensure personnel security and vetting?

Accepted Answer

All employees with potential access to Federal environments are U.S. Persons and undergobackground screening per FedRAMP® PS-3 controls.Access reviews, role verification, and least-privilege enforcement are conducted quarterly.

Question 18

What is our closed-boundary architecture

Accepted Answer

AutogenAI’s Federal offering operates entirely within a FedRAMP® High enclave with controlled,egress-restricted architecture. No external AI, public web access, or outbound connections,minimizing attack surface and ensuring data never leaves the secure boundary.

Question 19

Where can we find official documentation and compliance status updates?

Accepted Answer

All documentation is published in the AutogenAI Trust Centre at trust.autogenai.com including:FedRAMP® High authorized.Security and compliance documentationAudit summaries and 3PAO reportsSecurity team contact information