Specset — FedRAMP Public Information

Specset Cloud Platform (SCP) · FedRAMP 20x · Initial Implementation · last generated 2026-10-14

Machine-readable format: https://specset.com/fedramp/fedramp.json
Conforms to the FedRAMP Certification Package Overview schema (2026-06-24). Served as application/json with no authentication, approval workflow, or access justification required.

This page publishes the information required by FedRAMP CDS-CSO-PUB (Public Information). Every enumerated field is listed below; fields that do not yet apply to Specset's current stage are stated explicitly rather than omitted.

FedRAMP ID

FR2631258135
FedRAMP Marketplace listing

Service Model

SaaS

Deployment Model

Public Cloud

Business Category

Artificial Intelligence (AI), Construction

UEI Number

S7RZBSZXNBD5

Sales Contact Information

sales@specset.com

Security Contact Information

FedRAMP Security Inbox · fedramp@specset.com

Product Website

https://specset.com

Product Logo

https://specset.com/fedramp/specset-logo.png

Overall Service Description

The Specset Cloud Platform is an AI platform for construction document review. It automates technical review across project manuals, drawing sheets and shop drawings: submittal review against project specifications, UFGS (Unified Facilities Guide Specifications) compliance checking, design review automation, asset management logic, and search and question answering across a project's documents. The platform flags potential issues and returns cited answers drawn from the customer's own project documents. Specset is the trade name of Spot.xyz Corporation, formerly Specbook. The SOC 2 Type II report supporting this package is issued to Spot.xyz Corporation DBA Specset, and the Unique Entity Identifier above is registered to that entity. FedRAMP ID FR2631258135 is the sole active Marketplace listing for this offering; a duplicate listing created at intake, FR2631747321, is pending retirement, requested 2026-08-31.

Services and Security Categories

Service	Description	Security category	Minimum Assessment Scope	Available since
Specset Cloud Platform	The offering as a whole: one multi-tenant SaaS service for construction document intelligence, used in a web browser on a computer or phone. An organization's members keep the project record in it (project manuals and specifications, drawing sets, submittals, RFIs, daily logs and photos, issues and documents), and every feature listed below runs on that record inside the same boundary. Production runs on Google Cloud in project specset-prod-assured (Assured Workloads, FEDRAMP_MODERATE control package, us-west1), with the supporting services listed under third-party information resources. Security category: Moderate (FIPS 199), reflecting the Controlled Unclassified Information the service handles for defense and federal customers. The whole service carries that one category, and no feature carries a different one. A per-organization CUI mode keeps model, embedding and web-grounding calls in the Assured Workloads project (Vertex AI, location us), turns off the commercial AI and support-chat integrations and the Procore and Autodesk integrations, and never calls Perplexity. Federal tenants are provisioned with CUI mode enabled.	Moderate	Included	2025-01-22
Ask the project (Q&A chat)	Plain-language questions from anywhere in a project, answered from the project's own documents with a citation to each source.	Moderate	Included
Design quality review	Reviews specifications and drawings in project-wide context and returns conflicts, omissions and constructability risks, each cited to its source.	Moderate	Included
Submittal review	Reviews submittal packages (mix designs, shop drawings, product data, safety plans and more) against the applicable project requirements and returns the package annotated.	Moderate	Included
Plan comparison	Compares two plan sets, or two revisions of one sheet, and returns each change matched by sheet and classified by what it touches.	Moderate	Included
Document generation	Drafts documents such as safety plans, quality-control plans, closeout forms and proposal sections from the project record into the customer's own Word template.	Moderate	Included
RFIs & revisions	Tracks each RFI against the conformed specifications and current drawings, and checks the answer before it reaches the field.	Moderate	Included
Submittal log	Reads the project manual and builds a cited register of the product data, samples, shop drawings and closeout packages it requires.	Moderate	Included
Spec intelligence	Merges the base specification, every addendum and the special provisions into one conformed text per section, searchable and cited to the paragraph.	Moderate	Included
Bid screening	Extracts opportunities from bid boards and notices and reads the invitation for damages, bonding, set-asides and schedule risks. Reading a public bid-portal page uses Firecrawl, listed under third-party information resources with its CUI-mode gap and plan.	Moderate	Included
Contract review	Works the agreement, conditions and special provisions through a checklist and returns a severity-flagged review table.	Moderate	Included
Schedule intelligence	Imports a Primavera P6 or Microsoft Project schedule, computes the network and answers questions about what slipped, what drives the finish and what comes next.	Moderate	Included
Closeout & operations (F&M portal)	Turns the specifications, equipment schedules, submittals and O&M package into a structured facility record of assets, warranties and maintenance schedules, which the owner's team uses through the F&M portal after handoff.	Moderate	Included
Custom skills	Lets an organization write down its own procedure (a checklist, an extraction or a deliverable in its template) for the agents to run on every project.	Moderate	Included
Specset API, command-line tool and AI-assistant connectors	The Specset API, the specset command-line tool, and the connector (MCP) through which a member uses Specset from Claude, ChatGPT or Codex. Each acts with the member's own sign-in and permissions. The API and the connector endpoint run inside the service; the assistant a member connects is not part of the offering (see Not included).	Moderate	Included
Procore and Autodesk Construction Cloud integrations	Optional, customer-initiated connections to the customer's own Procore or Autodesk tenant through OAuth, moving only the records the customer chooses. Not available to an organization in CUI mode: an application gate stops it from connecting either integration and makes an existing connection inert.	Moderate	Included

Not included

Item	Why	Minimum Assessment Scope
AI assistants a member connects (Claude, ChatGPT, Codex)	The assistant runs on its own provider's service under the customer's account with that provider. What a member retrieves into it through the connector leaves the offering at the member's direction and is outside the Minimum Assessment Scope.	Not included
The customer's own Procore and Autodesk tenants	The integrations listed above are included; the tenants they connect to are the customer's own systems.	Not included

Secure Configuration Guidance

https://docs.specset.com/docs/secure-configuration
Specset's Secure Configuration Guide (SCG-CSO-RSC), a public page in the product documentation written for the administrators of a customer organization: the roles that control an organization and the FedRAMP term for each, the recommended security settings for an organization that holds federal information or CUI and what each does, how Admin accounts are set up, reviewed and removed, and how account access is requested and recovered. It gives the recommended settings in JSON with the API query that exports an organization's current settings for comparison, and the version history of the recommended settings.

Documentation Overview

Document	Type	Summary	Availability
Security Decision Record (SDR)	JSON + Markdown (FedRAMP 2026-06-24 schema)	Per-rule and per-KSI implementation, validation and assessment statements for the Class A package, with SOC 2 Type II control mappings and a gap statement for each partially implemented rule.	Supplied with the Class A application; a restricted trust-center resource open to access requests since 2026-09-14, no NDA.
Ongoing Certification Report (OCR) — example	JSON + Markdown (FedRAMP 2026-06-24 schema)	Schema-conformant example of the quarterly report of certification-data changes, planned changes, accepted vulnerabilities, agencies and reportable incidents, labeled as an example. The first report is due 2026-12-01.	Supplied with the Class A application; a restricted trust-center resource open to access requests since 2026-09-14, no NDA.
Information-resources inventory (MAS-CSO-IIR)	JSON + Markdown (generated), with generator, sources and derivation method	Every cloud account, project and third-party service that handles federal customer data or can affect its confidentiality, integrity or availability, with location, boundary membership, encryption and CUI routing.	Supplied with the Class A application; a restricted trust-center resource open to access requests since 2026-09-14, no NDA.
SOC 2 Type II report	PDF (restricted use)	Prescient Assurance LLC, issued 2026-08-31, Security Trust Services Criteria, period 2026-04-15 to 2026-07-15, unqualified opinion, no exceptions on 131 tested controls. This is the approved alternative security framework assessment that Class A rests on (FRC-CLA-ASF). Independent verification and validation of the certification package by a FedRAMP Recognized independent assessment service is optional at Class A (FRC-CLA-IVV), and none is engaged for this submission. An independent assessor, Prescient Security, LLC. (Assessor ID 202040, the assessor named in this document), is engaged for the Class C assessment that follows. The management representation letter accompanying the report is retained in the evidence repository and supplied with the application and on request to fedramp@specset.com.	Trust center (trust.specset.com), restricted resource open to access requests, view only, no NDA
SOC 2 Type II engagement documentation	PDF (restricted use)	Verified engagement documentation for the completed examination, dated 2026-08-25. The next report is planned after the 2026-07-16 to 2027-07-15 period ends and before 2027-08-31. The renewal engagement letter for that period with Prescient Assurance LLC, dated 2026-09-08, was executed on 2026-09-25. Gap: no assessor bridge or gap letter covers 2026-07-16 to the application date. Plan: settle the bridge-letter position with the assessor during the FedRAMP review and supply any letter issued with the assessment materials.	Trust center: the 2026-08-25 engagement letter and the executed renewal letter are private resources supplied on request to fedramp@specset.com.
Incident Response Procedure	Markdown / PDF	Detection, triage, FedRAMP reportability evaluation, initial and final incident reporting (IEC-CSO-EFR / IIR / OIR / FIR), and the FedRAMP Security Inbox procedure.	Supplied with the Class A application; a restricted trust-center resource open to access requests since 2026-09-14, no NDA.
Vulnerability Management Procedure	Markdown / PDF	Persistent detection (Dependabot security alerts and CodeQL code scanning on the application and infrastructure repositories, Artifact Registry image scanning of deployed digests), PAIN-based evaluation within 14 days of detection (5 days from 2026-11-01), the Class C remediation timeframes, which also meet the Class A ones, and adoption of the VDR / VER rulesets ahead of the 2026-12-07 mandate.	Supplied with the Class A application; a restricted trust-center resource open to access requests since 2026-09-14, no NDA.
Security policies	PDF (Vanta policy documents)	The fifteen company policies and plans approved and maintained in Vanta, with employee acceptance recorded there: access control (which carries the password requirements), asset management, business continuity and disaster recovery, code of conduct, cryptography, data management, human resource security, incident response, information security and acceptable use (which carries the mobile device requirements), information security roles and responsibilities, operations security (which carries the change management and data leakage prevention requirements), physical security, risk management, secure development and third-party management. Each is listed with its version, date of last update and word count under Policies and procedures.	Maintained in Vanta with employee acceptance records; not published on the trust center; supplied on request to fedramp@specset.com.
Vulnerability activity reports	Markdown + JSON, monthly	Monthly vulnerability detection and response activity (VER-TFR-MRH). First report 2026-10-01.	Published as a restricted trust-center resource, no NDA, from 2026-10-01
Recovery plan	Markdown / PDF	The recovery plan for the offering (KSI-RPL-ARP): service recovery objectives of RTO 24 elapsed hours and RPO 15 minutes (KSI-RPL-RRO), per-datastore backup and recovery procedures aligned to those objectives (KSI-RPL-ABO), and the recovery testing cadence (KSI-RPL-TRC). Delivered as supporting-evidence document 12, "Recovery and Backup Configuration".	Published as supporting-evidence document 12, "Recovery and Backup Configuration", a restricted trust-center resource open to access requests, no NDA.
Training effectiveness review (KSI-CED-RAT)	JSON	Four-category review of security training effectiveness for all staff, completed 2026-09-12, with follow-up actions. Next review 2026-12-01.	Supplied with the Class A application; published within supporting-evidence document 6, "Training Effectiveness Review", a restricted trust-center resource open to access requests since 2026-09-14, no NDA.
Incident register and simulated Final Incident Report	Markdown + JSON (FedRAMP incident report schema)	Incident register entries, the quarterly review record, and a simulated tabletop exercise with its reportability evaluation and schema-valid Final Incident Report.	Supplied with the Class A application; published within supporting-evidence document 7, "Incident Response Records", a restricted trust-center resource open to access requests since 2026-09-14, no NDA.
Class A supporting evidence documents	Twelve PDFs, each with its source exports as appendices	Twelve documents, one per artifact the Security Decision Record cites by name, so a reviewer opens exactly what the record points to: change management record; network boundary and Cloud Armor configuration; egress enforcement verification; identity and access configuration; staff authentication verification; training effectiveness review; incident response records; encryption and secrets configuration; vulnerability detection baseline and exception EX-2026-001; information resources inventory sources; assessment materials and schedule; and recovery and backup configuration. Each states the facts, the rule identifiers it evidences and its source records, with the machine-readable export appended.	Supplied with the Class A application; a restricted trust-center resource open to access requests since 2026-09-14, no NDA.
Service availability (CDS-CSO-AVR)	Web page + JSON + RSS	Current status, 90-day per-service history and incidents, hosted independently of the offering; machine-readable at https://status.specset.com/index.json?format=json (JSON) and https://status.specset.com/feed.rss (incident RSS).	Public: https://status.specset.com
Secure configuration guidance	Web page	The Secure Configuration Guide for the administrators of a customer organization: the roles that control an organization, the recommended security settings for an organization that holds federal information or CUI, managing Admin accounts, and account access. The Secure Configuration Guide rules (SCG-CSO) apply to Classes B, C and D, not to Class A; the guide was published on 2026-10-03, ahead of the Class C application, and is linked from serviceProperties.secureConfigurationGuidance in this document.	Public, no login: https://docs.specset.com/docs/secure-configuration

Trust Center

https://trust.specset.com
Access instructions: The landing page at https://trust.specset.com requires no login. FedRAMP staff and agency reviewers request access to the restricted FedRAMP Certification Data from the Trust Center page. Requests from fedramp.gov and gsa.gov email addresses are approved automatically; Specset approves all other requests manually. Specset does not require acceptance of terms or a non-disclosure agreement. If a request is not approved within one business day, email fedramp@specset.com.

Next Ongoing Certification Report Date

2026-12-01

Third-Party Information Resources

FedRAMP Certified (8)

FedRAMP ID	Use
FR1805751477	Google Cloud Platform (Google Services) — primary hosting of all production infrastructure in project specset-prod-assured (Assured Workloads): GKE Autopilot, Cloud SQL, Cloud Storage, Memorystore, Cloud KMS, Cloud Load Balancing and Cloud Armor, Cloud Logging and Monitoring, Secret Manager, Artifact Registry, and Vertex AI (Gemini) model inference, embeddings and Web Grounding for Enterprise. Organizations in CUI mode use Vertex AI in the Assured Workloads project at location us only; other organizations use Vertex AI in a peer Google Cloud project, specbook-production, outside Assured Workloads. Stores and processes customer data. A third Google Cloud project, specbook-development, holds the development user-content buckets, development service identity and development vendor-key secrets; it sits outside Assured Workloads and inside the assessment scope because it shares integration credentials and software delivery with production. It does not handle federal customer data. A founder-run project-clone tool is built to copy a production project into the founder's local development environment on their laptop for debugging, not into this project (a full clone does not check that its object store is local), so a founder's laptop may hold customer content of organizations not in CUI mode. Specset enables CUI mode on any tenant provisioned for a federal customer before federal content is uploaded; the clone tool refuses any organization in CUI mode, for a full clone since 2026-10-12 and for a re-copy of an already-cloned project's files since 2026-10-13, and no organization now in CUI mode has been cloned. Two further Google Cloud projects are inside the assessment scope and hold no customer content: specset-dataroom, an investor data room with no connection to the offering, and vanta-scanner, which holds the compliance scanner's federated identity and read-only custom roles outside the boundary project.
AGENCYAMAZONEW	AWS US East/West — supporting services: Amazon SES (transactional email), Route 53 (DNS), S3 (CI build cache, CloudTrail audit logs, and a legacy database-backup bucket from the pre-2026 hosting platform), GuardDuty (threat detection), and Amazon Bedrock (Claude model inference entered in us-west-2 through United States inference profiles, except Claude Sonnet 5.5, whose global profile may process requests in any AWS commercial Region; for organizations not in CUI mode only; prompts may include customer document text).
F1209051525	Azure Commercial Cloud — Azure OpenAI (GPT model inference for organizations not in CUI mode; prompts may include customer document text) and Microsoft Entra ID application registrations for customer 'Sign in with Microsoft' single sign-on. No customer data is stored on Azure.
F1206081364	Google Workspace — provider identity (Cloud Identity) for staff access to production through Identity-Aware Proxy, with security-key or passkey 2-Step Verification enforced for all staff; staff email including the FedRAMP Security Inbox. No customer data.
FR1812058188	GitHub Enterprise Cloud — source control and CI/CD for the application and infrastructure-as-code. Dependabot security alerts and CodeQL code scanning run on the application and infrastructure repositories, with Dependabot version updates on the infrastructure repository. Deploys to production through OpenID Connect workload identity federation. GitHub also hosts the marketing website repository, whose continuous integration publishes the website and the public copy of this document; Dependabot runs on it, and the website publisher can write only the website bucket. No customer data.
FR2525556241	Vanta Trust Management Platform — continuous configuration monitoring of the production cloud accounts (read-only metadata), compliance evidence and policies, and the Specset Trust Center at trust.specset.com. No customer data.
FR1823447014	Slack — operational alerting and change-notification channel for the provider (infrastructure change notifications, security alerts), and delivery of prospect inquiries from the public website's contact form. Resource metadata and prospect contact details only; no customer content or customer-user data.
FR2604643715	Perplexity Enterprise and API Platform (FedRAMP Certified, Class B) — web search for AI features of organizations not in CUI mode. Receives model-generated search queries; customer documents are not sent. Never called for organizations in CUI mode: their web lookups run on Vertex AI Web Grounding for Enterprise inside the Google Cloud Assured Workloads project.

Not FedRAMP Certified (12)

Resource	Use
Anthropic API (Claude, direct) Anthropic, PBC	Direct Claude model inference for a small set of models not served through Amazon Bedrock, selectable only by Specset administrators; prompts may include customer document text. Never enabled for organizations in CUI mode.
Intercom Intercom, Inc.	In-app customer support chat for organizations not in CUI mode. Processes customer user contact details and support conversation content; no project documents. The messenger never loads for an organization in CUI mode and its memberships are never shared with Intercom.
Google Generative AI (AI Studio) Google LLC	Gemini API path outside the Google Cloud FedRAMP boundary, used as the embedding provider for organizations not in CUI mode; prompts may include customer document text. Never used for organizations in CUI mode, whose embeddings run on Vertex AI in the Assured Workloads project. Retirement is planned before the Class C application.
Cloudflare Workers AI Cloudflare, Inc.	Cloudflare AI Gateway and Workers AI for experimental open-model inference selectable by organizations not in CUI mode. Prompts may include customer document text, and inference runs in Cloudflare data centers worldwide. The gateway does not store prompt or completion payloads, and the per-organization CUI mode excludes it. Cloudflare also supplies the edge fronting for the Trust Center custom hostname (trust.specset.com) as part of Vanta's Trust Center service; that use carries no customer data. The Cloudflare for Government offering is not used.
NOAA / National Weather Service APIs US National Oceanic and Atmospheric Administration (federal agency)	Public weather and tide data for project daily logs. Receives a project site's latitude and longitude only; forecasts and tide data are returned to the daily log. Nothing is stored at the service. A US federal government data service, not a cloud service offering.
Apryse Apryse Software Inc. (formerly PDFTron Systems Inc.)	Document-processing software from one vendor, used two ways, both inside the boundary or in the user's browser. The server-side PDF library runs in the application and worker pods on customer documents, and the structured-output module it needs is downloaded from the vendor at container image build and pinned by SHA-256 checksum. The browser viewer runs under an offline OEM license key, so viewing makes no call to the vendor. No customer document data is sent to the vendor; the resource is in scope as a software-supply-chain dependency that affects document-processing availability and build integrity.
Autodesk Platform Services Autodesk, Inc.	Optional customer-initiated integration to the customer's own Autodesk tenant through OAuth; the customer chooses and authorizes the data exchanged. Not used unless a customer connects it. Disabled for organizations in CUI mode: an application gate, deployed 2026-09-13, stops an organization in CUI mode from connecting the integration and makes an existing connection inert.
Procore Procore Technologies, Inc.	Optional customer-initiated integration to the customer's own Procore tenant through OAuth; the customer chooses and authorizes the data exchanged. Not used unless a customer connects it. Disabled for organizations in CUI mode: an application gate, deployed 2026-09-13, stops an organization in CUI mode from connecting the integration and makes an existing connection inert.
Claude Code (Anthropic) — engineering assistant Anthropic, PBC	Coding assistant used by the founders on operator laptops. It is in the assessment scope because what it reads is sent to the model provider and can include federal customer data. It acts with the operating founder's own access, and the founder operating it is responsible for what it reads. Specset's rule since 2026-10-09 is that data of organizations in CUI mode must not reach an engineering assistant, and the tooling keeps its default reads inside that rule. Infrastructure reads go through a dedicated read-only service account with reader roles only, no secret values and no write permission on production; since 2026-10-10 it cannot read the database rows of organizations in CUI mode, credential tables or Data Access audit logs, and it sees those organizations' application log entries only as sanitized copies. Database rows are read through a time-limited tunnel that a founder approves each session, with Cloud SQL IAM authentication and SELECT-only grants. Every tunnel start is recorded as an Admin Activity audit entry, and an alert fires if the account ever appears as the principal of a write.
OpenAI Codex — engineering assistant OpenAI	Coding assistant used by the founders on operator laptops, in the assessment scope on the same terms as Claude Code. It acts with the operating founder's own access, under the founder's responsibility for what it reads and the rule that data of organizations in CUI mode must not reach an engineering assistant. It reads the infrastructure as the same read-only service account, which has no write permission on production, and reads database rows through the founder-approved, SELECT-only, time-limited tunnel. Every tunnel start is recorded as an Admin Activity audit entry, and an alert fires on any write by that account. What it reads is sent to the model provider.
Firecrawl Mendable Labs, Inc.	Two dependencies on one vendor. The hosted scraper reads public bid-portal pages for specification research and receives the page URL together with the extraction instructions the assistant's model wrote, which may derive from a user's conversation; no document, embedding or database row is sent. The vendor's PDF parser is a pinned software dependency that runs inside the boundary on customer PDFs, so no customer document reaches the vendor through it. Gap: the scrape tool is not gated on CUI mode, so an organization in CUI mode can reach this non-certified vendor. Plan: apply the integration CUI gate to the tool and its workflow activity before the 2026-12-01 Ongoing Certification Report.
Customer single sign-on identity providers (Google Sign-In and customer-configured OpenID Connect providers) The customer's own identity provider (Google Sign-In, or any OpenID Connect provider a customer configures)	Customer-chosen authentication for customer users. Specset receives the identity assertion and the claims the customer's provider releases; no project document or row leaves the boundary. Each provider is the customer's own information resource under the customer's own administration, so its certification status is the customer's decision. Corporate Google single sign-on is enforced for Specset staff and superadmin access.

FedRAMP Recognized Independent Assessor

Prescient Security, LLC. (Assessor ID 202040)

Policies and procedures

Every policy and procedure in the FedRAMP Certification Data (CDS-CSO-IRP), with the version and word count of the edition currently supplied. The availability column says how to obtain each; restricted documents are requested on the trust center or from the security contact above.

Name	File	Summary	Words	Version	Last updated	Related FedRAMP practices	Availability
Incident Response Procedure Procedure	incident-response.pdf	Incident detection, triage, FedRAMP reportability evaluation, initial, ongoing and final incident reports, the FedRAMP Security Inbox procedure and the quarterly review.	3788	2026-10-14	2026-10-14	IEC-CSO-EFR, IEC-CSO-EFI, IEC-CSO-DPR, IEC-CSO-IIR, IEC-CSO-OIR, IEC-CSO-FIR, IEC-CSO-AIR, AFC-CSO-INB, AFC-CSO-NOC, AFC-CSO-TFG, AFC-CSO-RCV, AFC-CSO-CRA, AFC-CSO-EMR, AFC-CSO-IMA, AFC-CSO-ACK, CDS-UTC-AAD, KSI-INR-RIR, KSI-INR-AAR, KSI-INR-RPI	Trust center (https://trust.specset.com), restricted resource open to access requests, no NDA.
Vulnerability Management Procedure Procedure	vulnerability-management.pdf	Persistent vulnerability detection, PAIN-based evaluation, response timeframes, exceptions and risk acceptance, and the monthly vulnerability activity report.	4385	2026-10-14	2026-10-14	VDR (all rules), VER (all rules)	Trust center (https://trust.specset.com), restricted resource open to access requests, no NDA.
Recovery plan (Recovery and Backup Configuration) Plan	12-recovery-and-backup-configuration.pdf	Service recovery objectives, backup configuration by datastore, recovery procedures and the recovery testing cadence.	1157	2026-09-13	2026-09-13	KSI-RPL-ARP, KSI-RPL-RRO, KSI-RPL-ABO, KSI-RPL-TRC	Trust center (https://trust.specset.com), restricted resource open to access requests, no NDA.
Secure Configuration Guide Procedure	https://docs.specset.com/docs/secure-configuration	For the administrators of a customer organization: the accounts that control an organization, the recommended security settings for one holding federal information or CUI, and how account access is requested and recovered.	1288	2026.09.18.2	2026-10-07	SCG-CSO-RSC, SCG-CSO-PUB, SCG-CSO-AUP, SCG-ENH-VRH	Public documentation page, no login.
Ongoing Certification Reports and Quarterly Reviews Procedure	ongoing-certification-reports.md	How the quarterly Ongoing Certification Report is assembled, checked for sensitive information and published, how questions about it are answered, the reviews held in the same quarterly slot and the Class C Quarterly Review.	1371	edition 2026-10-05	2026-10-05	CCM-OCR-AVL, CCM-OCR-NRD, CCM-OCR-SOR, CCM-OCR-FBM, CCM-OCR-AFS, CCM-OCR-LSI, CCM-OCR-RPS, CCM-QTR-MTG, CCM-QTR-SAR, CCM-QTR-REG, CCM-QTR-NRD, CCM-QTR-ACT, CCM-QTR-RTR, CCM-QTR-RTP, CCM-QTR-NID, CCM-QTR-SCR, CCM-QTR-SRR, CDS-CSO-HAD, CDS-CSO-RIS, CPO-CSX-CPM, KSI-CMT-RVP	Class C package procedure; supplied on request to fedramp@specset.com until the Class C package is filed with it.
Significant Change Notification procedure Procedure	significant-change-notification.md	How each production change is evaluated for significance, confirmed by an operator, recorded and, when significant, notified.	3132	edition 2026-10-07	2026-10-07	SCN (all rules), KSI-CMT-LMC	Class C package procedure; supplied on request to fedramp@specset.com until the Class C package is filed with it.
Use of representative samples Procedure	use-of-representative-samples.md	Every place where Specset's own verification and validation looks at a sample instead of a whole population, and why the sample stands for the rest.	476	edition 2026-10-05	2026-10-05	IVV-CSO-USR, IVV-CSO-DUS	Class C package procedure; supplied on request to fedramp@specset.com until the Class C package is filed with it.
Privileged access procedure Procedure	privileged-access.md	How the founders obtain administrative access to production per task, with a reason and for a limited time, through Privileged Access Manager, and the last-resort path.	2661	edition 2026-10-09	2026-10-09	KSI-IAM-JIT, KSI-IAM-ELP	Class C package procedure; supplied on request to fedramp@specset.com until the Class C package is filed with it.
Access Control Policy Policy	Access Control Policy (Vanta policy document)	Limits access to information and information-processing systems, networks and facilities to authorized parties, including account management, authentication and password requirements.	2719	3.1	2026-09-11	KSI-IAM-AAM, KSI-IAM-APM, KSI-IAM-ELP, KSI-IAM-JIT, KSI-IAM-SNU, KSI-IAM-SUS, KSI-MLA-ALA	Approved and maintained in Vanta with employee acceptance records; supplied on request to fedramp@specset.com.
Asset Management Policy Policy	Asset Management Policy (Vanta policy document)	Identifies the organization's assets and who is responsible for protecting them, and prevents unauthorized disclosure, modification, removal or destruction of information on media.	548	3.0	2026-05-29	MAS-CSO-IIR, KSI-PIY-GIV	Approved and maintained in Vanta with employee acceptance records; supplied on request to fedramp@specset.com.
Business Continuity and Disaster Recovery Plan Plan	Business Continuity and Disaster Recovery Plan (Vanta policy document)	Continuity of critical services in a disaster, the responsibilities and communications, and the recovery time and recovery point objectives.	2386	3.1	2026-09-14	KSI-RPL-ARP, KSI-RPL-RRO, KSI-RPL-ABO, KSI-RPL-TRC, KSI-CNA-OFA	Approved and maintained in Vanta with employee acceptance records; supplied on request to fedramp@specset.com.
Code of Conduct Policy	Code of Conduct (Vanta policy document)	The conduct expected of all staff, for safe and collaborative working conditions, and the consequences of unacceptable behavior.	1107	3.0	2026-05-29	—	Approved and maintained in Vanta with employee acceptance records; supplied on request to fedramp@specset.com.
Cryptography Policy Policy	Cryptography Policy (Vanta policy document)	Requirements for cryptographic keys and methods across the encryption lifecycle, so that cryptography protects the confidentiality, authenticity and integrity of information.	416	3.0	2026-05-29	CMU-CSO-CMD, CMU-CSO-UVM, KSI-SVC-SIN, KSI-SVC-VCM, KSI-SVC-ASM	Approved and maintained in Vanta with employee acceptance records; supplied on request to fedramp@specset.com.
Data Management Policy Policy	Data Management Policy (Vanta policy document)	Classification, protection, retention and secure disposal of information according to its importance; version 3.2 amends the retained version 3.0 text.	3165	3.2	2026-10-05	KSI-SVC-RUD, KSI-SVC-SIN	Approved and maintained in Vanta with employee acceptance records; supplied on request to fedramp@specset.com.
Human Resource Security Policy Policy	Human Resource Security Policy (Vanta policy document)	Screening, security responsibilities, training and suitability of personnel and contractors, before, during and after employment.	1024	3.1	2026-09-14	KSI-CED-RAT	Approved and maintained in Vanta with employee acceptance records; supplied on request to fedramp@specset.com.
Incident Response Plan Plan	Incident Response Plan (Vanta policy document)	The organizational plan for managing information security incidents and events; version 3.1 amends the retained version 3.0 text, and the Incident Response Procedure carries the FedRAMP reporting steps.	5453	3.1	2026-09-14	IEC (all rules), KSI-INR-RIR, KSI-INR-AAR, KSI-INR-RPI	Approved and maintained in Vanta with employee acceptance records; supplied on request to fedramp@specset.com.
Information Security Policy (Acceptable Use) Policy	Information Security Policy (AUP) (Vanta policy document)	The company's information security policies and the acceptable use and protection of its information and assets, including mobile devices.	2521	3.0	2026-05-29	—	Approved and maintained in Vanta with employee acceptance records; supplied on request to fedramp@specset.com.
Information Security Roles and Responsibilities Policy	Information Security Roles and Responsibilities (Vanta policy document)	Who in the company is responsible for which part of information security, so that policies are communicated and responsibility is clearly assigned.	914	3.0	2026-05-29	KSI-PIY-RES	Approved and maintained in Vanta with employee acceptance records; supplied on request to fedramp@specset.com.
Operations Security Policy Policy	Operations Security Policy (Vanta policy document)	Secure operation of information-processing systems, including change management, logging and monitoring, malware and vulnerability handling and data leakage prevention.	3497	3.2	2026-10-08	KSI-CMT-LMC, KSI-CMT-RVP, KSI-MLA-LET, KSI-MLA-RVL	Approved and maintained in Vanta with employee acceptance records; supplied on request to fedramp@specset.com.
Physical Security Policy Policy	Physical Security Policy (Vanta policy document)	Prevents unauthorized physical access to, and damage to, the organization's information and information-processing facilities; production facilities are Google Cloud's.	743	4.0	2026-05-29	—	Approved and maintained in Vanta with employee acceptance records; supplied on request to fedramp@specset.com.
Risk Management Policy Policy	Risk Management Policy (Vanta policy document)	How information security risks and opportunities are identified and treated, and the plan for reaching the security and privacy objectives.	2674	3.0	2026-05-29	—	Approved and maintained in Vanta with employee acceptance records; supplied on request to fedramp@specset.com.
Secure Development Policy Policy	Secure Development Policy (Vanta policy document)	Security designed and implemented within the development lifecycle of applications and information systems.	976	3.1	2026-09-14	KSI-PIY-RSD, KSI-CMT-VTD, KSI-SCR-MIT	Approved and maintained in Vanta with employee acceptance records; supplied on request to fedramp@specset.com.
Third-Party Management Policy Policy	Third-Party Management Policy (Vanta policy document)	Protection of data and assets shared with, accessible to or managed by suppliers, and the agreed level of security and service in supplier agreements.	1321	3.0	2026-05-29	MAS-CSO-TPR, KSI-SCR-MIT, KSI-SCR-MON	Approved and maintained in Vanta with employee acceptance records; supplied on request to fedramp@specset.com.

Cryptographic modules

Each place where cryptography protects federal customer data in the Specset Cloud Platform, the module that performs it and its status under the NIST Cryptographic Module Validation Program (CMVP). Modules that Google operates inside its services are BoringCrypto: Google states that it holds FIPS 140-3 certificate 5104, which NIST lists as active, and Google Cloud KMS keys at the software protection level use the same module. Which certificate covers the build behind each Google service is Google's statement, which Specset relies on and cannot test. The TLS libraries inside the containers Specset runs are not CMVP-validated as deployed. The list was checked against the information-resources inventory and the Terraform configuration on 2026-10-07; certificate status and component releases are re-read at each quarterly Ongoing Certification Report.

What it protects	Module	Operated by	NIST CMVP status
Data at rest: Cloud SQL application and workflow databases and their backups. AES-256 under a customer-managed Cloud KMS key, software protection level, rotated every 90 days.	BoringCrypto (Cloud KMS, Cloud SQL)	Google	Validated: BoringCrypto, FIPS 140-3 certificate 5104 (active, validated 2025-12-09; certificate 4735 also active), as Google states for its services
Data at rest: Kubernetes Secrets in GKE etcd, including service credentials and the in-cluster certificate authority's private key. Application-layer encryption under a customer-managed Cloud KMS key, rotated every 90 days.	BoringCrypto (Cloud KMS, GKE)	Google	Validated: BoringCrypto, FIPS 140-3 certificate 5104 (active, validated 2025-12-09; certificate 4735 also active), as Google states for its services
Data at rest: Cloud Storage (customer documents and the audit-log archive), Cloud Logging buckets, Memorystore, Persistent Disk (search-embedding volumes and GKE node boot disks), Secret Manager and the Terraform state bucket. Google default encryption, AES-256.	BoringCrypto	Google	Validated: BoringCrypto, FIPS 140-3 certificate 5104 (active, validated 2025-12-09; certificate 4735 also active), as Google states for its services
Data in transit: users' browsers to the service. TLS 1.2 or later at Google's global HTTPS load balancer under a restricted SSL policy. The hop from the load balancer to the application is inside Google's network, and its protection is Google's and inherited.	Google Front End TLS (BoringSSL, whose core is BoringCrypto)	Google	Validated: BoringCrypto, FIPS 140-3 certificate 5104 (active, validated 2025-12-09; certificate 4735 also active), as Google states for its services
Data in transit: users' browsers to Cloud Storage. Documents are uploaded and read directly with signed URLs; TLS ends at Google's API front end under Google's own TLS configuration.	Google Front End TLS (BoringSSL, whose core is BoringCrypto)	Google	Validated: BoringCrypto, FIPS 140-3 certificate 5104 (active, validated 2025-12-09; certificate 4735 also active), as Google states for its services
Data in transit: application and workers to Cloud SQL. TLS 1.2 or later with the server certificate verified against the instance's own certificate authority; the instance refuses unencrypted connections.	Clients: OpenSSL as bundled with Node.js 24.21.0 in the application image; Go's standard TLS library in Temporal 1.32.0. Server: Cloud SQL.	Specset (clients); Google (server)	Not CMVP-validated as deployed (not built or run in an approved mode) for the clients; the server side is Google's, and Specset makes no separate claim for it
Data in transit: application to Memorystore for Redis. TLS only, with AUTH; the application verifies each server certificate against that instance's certificate authority.	Client: Node.js OpenSSL. Server: Memorystore.	Specset (client); Google (server)	Not CMVP-validated as deployed (not built or run in an approved mode) for the client; the server side is Google's, and Specset makes no separate claim for it
Data in transit: application and workers to the Qdrant vector database, and between Qdrant peers. TLS from the in-cluster certificate authority, an API key for clients and mutually authenticated TLS between peers.	Client: Node.js OpenSSL. Server and peers: rustls as built into Qdrant 1.19.0.	Specset	Not CMVP-validated as deployed (not built or run in an approved mode)
Data in transit: to the Temporal workflow service and between its services. TLS from the in-cluster certificate authority, verified by every client.	Server: Go's standard TLS library in Temporal 1.32.0. Clients: the Temporal TypeScript SDK 1.24.0 in the application image (worker connections through the SDK's Rust core on rustls; client connections on Node.js OpenSSL); Go's standard TLS library in the Temporal web UI 2.54.1, the Temporal admin tools 1.32.0 and the autoscaler (KEDA 2.21.0).	Specset	Not CMVP-validated as deployed (not built or run in an approved mode)
Data in transit: in-cluster certificate authority. cert-manager v1.21.2 issues the Temporal, autoscaler and Qdrant certificates (ECDSA P-256).	Go's standard cryptography library in cert-manager v1.21.2	Specset	Not CMVP-validated as deployed (not built or run in an approved mode)
Data in transit: administrative path to Cloud SQL. An operator's session reaches the in-cluster Cloud SQL Auth Proxy through a TLS-protected port-forward over Connect Gateway; the proxy carries it to the instance over TLS 1.3 with verified client and server identities.	Go's standard TLS library in Cloud SQL Auth Proxy 2.25.4 and in kubectl on the operator's machine; Google Front End TLS for Connect Gateway.	Specset (proxy, kubectl); Google (Connect Gateway)	Not CMVP-validated as deployed (not built or run in an approved mode) for the Go library; Google's front end as above
Data in transit: administrative browser path to the workflow console and the vector database, behind Identity-Aware Proxy on a second global HTTPS load balancer with the same restricted SSL policy. Behind it, the hop to the workflow console is inside Google's network and inherited, and the hop to the vector database is TLS.	Edge: Google Front End TLS. Vector database: rustls in Qdrant 1.19.0.	Google (edge); Specset (Qdrant)	Edge: Validated: BoringCrypto, FIPS 140-3 certificate 5104 (active, validated 2025-12-09; certificate 4735 also active), as Google states for its services. Qdrant: Not CMVP-validated as deployed (not built or run in an approved mode)
Data in transit: calls from the application to Google APIs inside the boundary (Vertex AI on the assured route, Cloud Storage, and the IAM Credentials API that signs Cloud Storage URLs).	Client: Node.js OpenSSL. Server: Google Front End TLS.	Specset (client); Google (server)	Not CMVP-validated as deployed (not built or run in an approved mode) for the client; server validated: BoringCrypto, FIPS 140-3 certificate 5104 (active, validated 2025-12-09; certificate 4735 also active), as Google states for its services
Data in transit: calls from the application to services outside Google Cloud listed under third-party information resources (for example Amazon SES, customer identity providers and, for organizations not in CUI mode, the commercial model and integration providers).	Client: Node.js OpenSSL. Server side and storage: the provider's own modules.	Specset (client); the provider (server)	Not CMVP-validated as deployed (not built or run in an approved mode) for the client; the provider's modules are covered by its own FedRAMP certification where the resource is listed as certified

Package metadata

Accountable official	Gordon Hempton, CEO and Co-Founder · gordon@specset.com
Version	2026.10.14
Last updated	2026-10-14T17:27:00Z
Source of update	github.com/specsetai/fedramp-marketplace (main branch; schema-validated by the repository's validate workflow; published to specset.com/fedramp/). Version 2026.10.14, published with Security Decision Record v2026.09.14.11: the engineering assistants are described as acting with the operating founder's own access, under the rule that data of organizations in CUI mode must not reach them, and the exclusion of those organizations' rows from the read-only service account's database role is in place since 2026-10-10; the project-clone tool refuses organizations in CUI mode, and the Google Cloud entry corrects where it is built to copy to: the founder's local development environment, not the development project. Version 2026.10.08's plan to also record that rule in the production-access procedure is withdrawn, since the tool enforces it; the policy and procedure reference gives the republished Incident Response and Vulnerability Management Procedures, the Privileged access procedure (edition 2026-10-09) and Operations Security Policy 3.2. Earlier versions are in this repository's history.