Request Access →
Compliance · As of October 2026

Designed for security and compliance on day one

We run a US-person-only, zero-data-retention AI gateway on FedRAMP High and DoD IL5 authorized cloud infrastructure. Consus is FedRAMP Equivalent, assessed by our 3PAO against all 410 FedRAMP High controls, and supports ITAR workloads. The body of evidence your CMMC assessor will ask for is available under NDA.

Top Level Compliance Summary
Active
Zero Data Retention
Prompts and completions never persist
Nothing you send through Consus is stored, by us or by the model provider. Zero data retention is in place with every upstream model provider, and only operational metadata (model, tokens, timestamps) is logged.
Active
ITAR Compliant
Export-controlled by design
The controls ITAR requires are built into how Consus runs: US persons only in the data plane (120.54(a)(5)), US-only cloud regions, and access that is logged and reviewed. Customers remain the registered exporter for their technical data.
Active
FedRAMP Equivalent
Assessed at the FedRAMP High baseline
DFARS 252.204-7012 requires any cloud that handles your CUI to meet FedRAMP Moderate or its equivalent (DoD memo). Although only Moderate is required, we worked with our 3PAO and assessed all 410 FedRAMP High controls. The body of evidence for your CMMC assessor is available under NDA.
Frameworks

What we claim and what backs it

FedRAMP Equivalency
DFARS 252.204-7012(b)(2)(ii)(D)
Completed

Under DFARS 7012, any cloud that handles your CUI must meet the FedRAMP Moderate baseline or its equivalent, and your CMMC assessor will check. If you integrate the cloud yourself, that equivalency audit is yours to run.

Required of Consus 100 percent compliance with all 323 Moderate baseline controls, assessed by a FedRAMP-recognized 3PAO and documented in a body of evidence. Consus went further: our 3PAO assessed all 410 FedRAMP High controls. The body of evidence goes straight into your CMMC package.
ITAR (22 CFR 120-130)
22 CFR 120.54(a)(5)
Satisfied

ITAR controls the export of defense technical data, and foreign-person access counts as a deemed export. The encryption carve-out at 22 CFR 120.54(a)(5) means end-to-end-encrypted data in transit is not an export, and data in transit is not deemed stored in any country it transits. No ITAR certification exists; companies self-certify.

Required of Consus US persons only in the data plane, US-only cloud regions, end-to-end encryption in transit with FIPS 140 validated modules, and no persistence of customer technical data. You stay the registered exporter for your technical data.
DoD Impact Level 5
DoD CC SRG IL5
Roadmap

DoD Impact Levels classify how sensitive the data a cloud may host is. IL5 covers higher-sensitivity CUI and unclassified national security systems, and the authorization attaches to the cloud and IaaS layer.

Required of Consus A Consus-specific IL5 authorization is on the roadmap, not in place today. What is in place now: Consus runs entirely on infrastructure that already holds IL5 P-ATO across AWS GovCloud, Azure Government, and GCP Assured Workloads, so the IL5 controls are inherited at the IaaS layer. The application-layer authorization is future work.
SOC 2 (Type I + Type II)
AICPA SOC 2
In progress

SOC 2 is an independent AICPA attestation on a service organization's security controls. Type I reports a point in time; Type II covers an observation window over time.

Required of Consus Complete an audit by an AICPA-accredited firm. The engagement is active, with the Type I point-in-time and the Type II observation window in progress. Vanta runs continuous control monitoring.
CMMC Level 2
NIST SP 800-171
Support role

CMMC is the DoD's certification that Defense Industrial Base contractors protect FCI and CUI, with Level 2 mapped to NIST 800-171. The certification applies to contractors, not to the cloud providers they use.

Required of Consus Not a certification Consus holds. Consus supports your Level 2 assessment by delivering a FedRAMP equivalency body of evidence, assessed at the High baseline, that you hand to your CMMC 3PAO.
Additional Compliance Details

The controls you can verify

The compliance story a program office can defend in one sentence: US soil, US people, validated crypto, zero data retention.

Region
US-only infrastructure
AWS GovCloud, Azure Government, and GCP Assured Workloads. No cross-border replication, ever.
Personnel
US persons only in the data plane
All personnel with production access are US persons per 120.54(a)(5). Access is logged and reviewed.
Boundary
Three isolated cloud authorizations
Each cloud has a separate FedRAMP authorization and a distinct customer-managed key. No shared key material across boundaries.
Crypto
FIPS 140 validated end to end
TLS 1.2+ in transit, AES-256 at rest, all on CMVP-validated modules. Cert numbers available in the evidence package.
Identity
No long-lived service account keys
Federated cloud access with ephemeral, short-lived credentials. Static-key creation blocked by organization policy.
Retention
Zero persistence of prompts or completions
Sanitized at every log boundary. Only operational metadata is retained — model, tokens, timestamps, routing decisions.
Shared responsibility

Who owns which control

A provider-level split of the 800-171 families most programs ask about. The per-control mapping is in the workbook we send under NDA.

Consus Customer
Control area What we do What you do
Identity & access800-171 3.1 · 3.5 ConsusAPI key authentication with per-key scoping. Policy headers enforce program, classification, and contract pinning per request. Gateway-side key rotation on schedule or on request. CustomerIssue and rotate your API keys. Scope keys to programs. Revoke on offboarding. Enforce your own IdP for the humans behind the keys.
Encryption800-171 3.13 ConsusTLS 1.2+ in transit, AES-256 at rest on FIPS 140 validated modules. Distinct customer-managed keys per cloud boundary. No shared key material. CustomerProtect your API keys in your own secret store. Rotate on schedule.
Audit logging800-171 3.3 ConsusEvery request is logged: model, provider, timestamp, token counts, and provider routing decision. Prompts and completions are not logged. Logs are encrypted under a customer-managed key, retained for 365 days, and available on request under NDA. CustomerLog prompts and completions on your side if required. Define what you need for your own compliance program. Request exports during audits or IR.
Personnel security800-171 3.9 ConsusData plane personnel are US persons per 120.54(a)(5). Access reviews documented. Access logged. CustomerVet and clear your own end users. Decide who in your org gets API keys and at what scope.
Incident response800-171 3.6 · DFARS 7012 ConsusDetection and containment at the gateway layer. Customer notification within 24 hours of a confirmed incident. DoD CIO notification within 72 hours via dibnet.dod.mil per DFARS 252.204-7012. Relevant logs preserved and shared under NDA. CustomerRun your own IR program. Notify Consus of incidents on your side that may affect gateway traffic. Remediate your systems and users.
Vulnerability management800-171 3.11 ConsusContinuous vulnerability monitoring. SLA-driven remediation: 30 days for Critical and High, 90 for Moderate, 180 for Low. CustomerMaintain your own vulnerability program for the systems calling our API.
CUI handling800-171 3.8 ConsusStateless pass-through. No request or response content is cached, stored, or made available to other users. Responses go directly to the authenticated caller. CustomerClassify your own data. Select the appropriate provider and model for the classification of each request. Define what counts as CUI within your program scope.
Data boundaryITAR ConsusUS-only cloud regions. No cross-border replication. US persons only in the data plane. CustomerKeep controlled data within the agreed boundary. Notify Consus of scope changes that affect classification or routing.
Body of Evidence

What you hand to your CMMC 3PAO

System Security Plan (SSP)

Full SSP and associated Appendices including User Guide, Digital Identity Worksheet, Rules of Behavior, and more.

PDF

Security Assessment Plan (SAP)

Security Test Case procedures & Penetration Test plan & results.

PDF

Security Assessment Report (SAR)

3PAO generated deliverables including: Risk Exposure Table, Penetration Test Reports, Infrastructure Scans, & Web Scans.

PDF

Plan of Action and Milestones (POA&M)

Current POA&M, Continuous Monitoring Strategy, and Continuous Monitoring Monthly Executive Summary.

Exported on request

Also available on request: internal vulnerability scan reports, dependency inventories, and AI-driven penetration test results. These are not formal audit artifacts — we share them because they're useful for a technical review.

Send this to your ISSO.

We'll set up an NDA and walk your compliance team through the evidence packet on a working call. No marketing slides.

Book a compliance call →