We are a security firm that ships a compliance platform.
Custodia is engineered by Carnegie Mellon–trained information security engineers, in the city where CMMC was half-built. Defense-in-depth is not a marketing line for us — it is the architecture, the runtime, the operating discipline, and the contract you sign.
How we protect Federal Contract Information.
We will not publish the full topology of our environment. That is itself a control. What we will publish is the architecture of intent— the principles we hold to, verifiable in contract, in code review, and in independent attestation.
Envelope encryption, key custody in AWS KMS.
Strong auth, least privilege, evidence-grade audit.
Tenant boundary enforced at the data layer.
Zero-retention, no-training, no exceptions.
Every layer assumes the layer above will fail.
The doctrine we teach customers is the doctrine we run on ourselves. Each control is independently verifiable. None of them is load-bearing alone.
Charlie is helpful. Charlie is not a backdoor.
AI is the most concentrated trust-boundary issue in modern software. We treat the model the way a careful firm treats a contractor with limited badge access: scoped, logged, and never trusted with the master key.
Custodia contracts only with enterprise model providers on zero-retention, no-training terms. Your prompts and evidence files are never used to train, fine-tune, or evaluate any model.
Each AI invocation receives the minimum context needed to answer the customer’s question. Context is discarded after the response. There is no persistent “memory” index of your FCI.
Retrieval-augmented prompts are scoped to a single tenant before they ever reach the model. A query for Tenant A cannot retrieve a record from Tenant B — enforced at the data layer, not in the prompt.
Untrusted content (uploaded files, third-party feeds) is treated as data, not instructions. Tool calls carry capability scopes and are bounded by server-side policy, not the model’s self-restraint.
We hold ourselves to the standard we sell.
Custodia’s control set is designed and operated consistent with the regimes our customers must satisfy. We respond to vendor security questionnaires in writing, with citations, on request.
The contract you can hold us to.
Incident response
A written incident response procedure is maintained and exercised. On confirmation of unauthorized acquisition of, or access to, customer data, we will notify affected customers without unreasonable delay and within seventy-two (72) hours of confirmation — consistent with DFARS 252.204-7012(c) and 73 P.S. § 2301 et seq. We provide reasonable assistance to customers fulfilling onward notification to DoD or other contracting agencies.
Coordinated vulnerability disclosure
Researchers may report suspected vulnerabilities to security@bidfedcmmc.com or via /.well-known/security.txt. We acknowledge reports within two (2) business days and offer a good-faith safe harbor for researchers who scope testing to their own accounts and give us a reasonable window to remediate before public disclosure.
Sub-processors & residency
All sub-processors are U.S. entities operating in the United States. Production data is stored and processed in the contiguous U.S. The current sub-processor list is published at /subprocessors. Material changes are notified in advance per contract.
Built in Pittsburgh, by people who studied this for a living.
Custodia was founded by an information security practitioner holding a Master of Science in Information Security Policy and Management from Carnegie Mellon University— the same campus that produced the CERT Coordination Center and seeded much of the doctrine inside the Cybersecurity Maturity Model Certification program. Half of CMMC is Pittsburgh and Baltimore; we sit on the Pittsburgh end of it.
That heritage is not a logo on a slide. It is the reason we wrote our key custody, tenant isolation, and AI boundary the way we did. We are operating the platform we would have wanted to audit.
Where we end and you begin.
Security is shared in every serious platform. We are explicit about the line.
See the Acceptable Use Policy for the full statement of customer responsibilities.
Federal bid-ready in seven days.
Start your CMMC Level 1 build on the same platform you just read about. Seven days free. No credit card required.