--- title: "Compliance · Consus" description: "Consus compliance posture: FedRAMP Equivalent, assessed against all 410 FedRAMP High controls, ITAR support, US persons only, zero data retention, and the evidence you hand your CMMC assessor." canonical: https://consus.io/compliance --- Compliance · As of October 2026 # Designed for security and compliance on day one We run a US-person-only, zero-data-retention AI gateway on FedRAMP High and DoD IL5 authorized cloud infrastructure. Consus is FedRAMP Equivalent, assessed by our 3PAO against all 410 FedRAMP High controls, and supports ITAR workloads. The body of evidence your CMMC assessor will ask for is available under NDA. Top Level Compliance Summary Active Zero Data Retention Prompts and completions never persist Nothing you send through Consus is stored, by us or by the model provider. Zero data retention is in place with every upstream model provider, and only operational metadata (model, tokens, timestamps) is logged. Active ITAR Compliant Export-controlled by design The controls ITAR requires are built into how Consus runs: US persons only in the data plane (120.54(a)(5)), US-only cloud regions, and access that is logged and reviewed. Customers remain the registered exporter for their technical data. Active FedRAMP Equivalent Assessed at the FedRAMP High baseline DFARS [252.204-7012](https://www.acq.osd.mil/dpap/dars/dfars/html/current/252204.htm#:~:text=D,-\)%C2%A0%20If%20the%20Contractor) requires any cloud that handles your CUI to meet FedRAMP Moderate or its equivalent ([DoD memo](https://dodcio.defense.gov/Portals/0/Documents/Library/FEDRAMP-EquivalencyCloudServiceProviders.pdf)). Although only Moderate is required, we worked with our 3PAO and assessed all 410 FedRAMP **High** controls. The body of evidence for your CMMC assessor is available under NDA. Frameworks ## What we claim and what backs it FedRAMP Equivalency DFARS 252.204-7012(b)(2)(ii)(D) Completed Under DFARS 7012, any cloud that handles your CUI must meet the FedRAMP Moderate baseline or its equivalent, and your CMMC assessor will check. If you integrate the cloud yourself, that equivalency audit is yours to run. Required of Consus 100 percent compliance with all 323 Moderate baseline controls, assessed by a FedRAMP-recognized 3PAO and documented in a body of evidence. Consus went further: our 3PAO assessed all 410 FedRAMP High controls. The body of evidence goes straight into your CMMC package. ITAR (22 CFR 120-130) 22 CFR 120.54(a)(5) Satisfied ITAR controls the export of defense technical data, and foreign-person access counts as a deemed export. The encryption carve-out at 22 CFR 120.54(a)(5) means end-to-end-encrypted data in transit is not an export, and data in transit is not deemed stored in any country it transits. No ITAR certification exists; companies self-certify. Required of Consus US persons only in the data plane, US-only cloud regions, end-to-end encryption in transit with FIPS 140 validated modules, and no persistence of customer technical data. You stay the registered exporter for your technical data. DoD Impact Level 5 DoD CC SRG IL5 Roadmap DoD Impact Levels classify how sensitive the data a cloud may host is. IL5 covers higher-sensitivity CUI and unclassified national security systems, and the authorization attaches to the cloud and IaaS layer. Required of Consus A Consus-specific IL5 authorization is on the roadmap, not in place today. What is in place now: Consus runs entirely on infrastructure that already holds IL5 P-ATO across AWS GovCloud, Azure Government, and GCP Assured Workloads, so the IL5 controls are inherited at the IaaS layer. The application-layer authorization is future work. SOC 2 Type II AICPA SOC 2 Completed SOC 2 is an independent AICPA attestation on a service organization's security controls. A Type II report covers how those controls operated over an observation window, not just at a single point in time. Required of Consus Complete an audit by an AICPA-accredited firm. Consus has completed its SOC 2 Type II audit, and the report is available under NDA. Vanta runs continuous control monitoring. CMMC Level 2 NIST SP 800-171 Support role CMMC is the DoD's certification that Defense Industrial Base contractors protect FCI and CUI, with Level 2 mapped to NIST 800-171. The certification applies to contractors, not to the cloud providers they use. Required of Consus Not a certification Consus holds. Consus supports your Level 2 assessment by delivering a FedRAMP equivalency body of evidence, assessed at the High baseline, that you hand to your CMMC 3PAO. Additional Compliance Details ## The controls you can verify The compliance story a program office can defend in one sentence: US soil, US people, validated crypto, zero data retention. Region US-only infrastructure AWS GovCloud, Azure Government, and GCP Assured Workloads. No cross-border replication, ever. Personnel US persons only in the data plane All personnel with production access are US persons per 120.54(a)(5). Access is logged and reviewed. Boundary Three isolated cloud authorizations Each cloud has a separate FedRAMP authorization and a distinct customer-managed key. No shared key material across boundaries. Crypto FIPS 140 validated end to end TLS 1.2+ in transit, AES-256 at rest, all on CMVP-validated modules. Cert numbers available in the evidence package. Identity No long-lived service account keys Federated cloud access with ephemeral, short-lived credentials. Static-key creation blocked by organization policy. Retention Zero persistence of prompts or completions Sanitized at every log boundary. Only operational metadata is retained — model, tokens, timestamps, routing decisions. Shared responsibility ## Who owns which control A provider-level split of the 800-171 families most programs ask about. The per-control mapping is in the workbook we send under NDA. Consus Customer | Control area | What we do | What you do | | --- | --- | --- | | Identity & access800-171 3.1 · 3.5 | ConsusAPI key authentication with per-key scoping. Policy headers enforce program, classification, and contract pinning per request. Gateway-side key rotation on schedule or on request. | CustomerIssue and rotate your API keys. Scope keys to programs. Revoke on offboarding. Enforce your own IdP for the humans behind the keys. | | Encryption800-171 3.13 | ConsusTLS 1.2+ in transit, AES-256 at rest on FIPS 140 validated modules. Distinct customer-managed keys per cloud boundary. No shared key material. | CustomerProtect your API keys in your own secret store. Rotate on schedule. | | Audit logging800-171 3.3 | ConsusEvery request is logged: model, provider, timestamp, token counts, and provider routing decision. Prompts and completions are not logged. Logs are encrypted under a customer-managed key, retained for 365 days, and available on request under NDA. | CustomerLog prompts and completions on your side if required. Define what you need for your own compliance program. Request exports during audits or IR. | | Personnel security800-171 3.9 | ConsusData plane personnel are US persons per 120.54(a)(5). Access reviews documented. Access logged. | CustomerVet and clear your own end users. Decide who in your org gets API keys and at what scope. | | Incident response800-171 3.6 · DFARS 7012 | ConsusDetection and containment at the gateway layer. Customer notification within 24 hours of a confirmed incident. DoD CIO notification within 72 hours via dibnet.dod.mil per DFARS 252.204-7012. Relevant logs preserved and shared under NDA. | CustomerRun your own IR program. Notify Consus of incidents on your side that may affect gateway traffic. Remediate your systems and users. | | Vulnerability management800-171 3.11 | ConsusContinuous vulnerability monitoring. SLA-driven remediation: 30 days for Critical and High, 90 for Moderate, 180 for Low. | CustomerMaintain your own vulnerability program for the systems calling our API. | | CUI handling800-171 3.8 | ConsusStateless pass-through. No request or response content is cached, stored, or made available to other users. Responses go directly to the authenticated caller. | CustomerClassify your own data. Select the appropriate provider and model for the classification of each request. Define what counts as CUI within your program scope. | | Data boundaryITAR | ConsusUS-only cloud regions. No cross-border replication. US persons only in the data plane. | CustomerKeep controlled data within the agreed boundary. Notify Consus of scope changes that affect classification or routing. | Body of Evidence ## What you hand to your CMMC 3PAO ### System Security Plan (SSP) Full SSP and associated Appendices including User Guide, Digital Identity Worksheet, Rules of Behavior, and more. PDF ### Security Assessment Plan (SAP) Security Test Case procedures & Penetration Test plan & results. PDF ### Security Assessment Report (SAR) 3PAO generated deliverables including: Risk Exposure Table, Penetration Test Reports, Infrastructure Scans, & Web Scans. PDF ### Plan of Action and Milestones (POA&M) Current POA&M, Continuous Monitoring Strategy, and Continuous Monitoring Monthly Executive Summary. Exported on request Also available on request: internal vulnerability scan reports, dependency inventories, and AI-driven penetration test results. These are not formal audit artifacts — we share them because they're useful for a technical review. ## Send this to your ISSO. We'll set up an NDA and walk your compliance team through the evidence packet on a working call. No marketing slides. [Book a compliance call →](https://cal.com/emagliarditi/consus-gateway-intro-discussion)