FORGE handles Controlled Unclassified Information exclusively on AWS GovCloud. No CUI transits commercial AWS. US-only data residency. US-citizen-only AWS operations.
⚠ Using commercial AWS for CUI is a DFARS compliance failure.
FORGE exists in part because operators kept asking: "Where is the GovCloud version?"
Every regulation that LOGCAP and SOFGLSS task orders impose — addressed at the platform level so you don't have to engineer compliance yourself.
Not retrofitted. Not adapted. Built from the first commit on GovCloud.
| GovCloud (us-gov-east-1) | Primary region — IL2 |
| GovCloud (us-gov-west-1) | DR region — IL2 |
| AWS KMS | Customer-managed encryption keys |
| CloudTrail | Multi-region audit log |
| GuardDuty | Continuous threat detection |
| Security Hub | Centralized compliance monitoring |
| AWS Config | Resource configuration tracking |
| Cognito + CAC/PIV | Identity & MFA |
| VPC + Security Groups | Network isolation |
| WAF v2 | Application firewall |
FORGE generates a live SOC 2 Type II readiness report — every control verified against actual AWS infrastructure state.
Your data is logically separated using DynamoDB partition keys. No cross-tenant queries possible.
Supplier pricing is visible only to authorized contractor procurement personnel — never to competitors.
ITAR-flagged records require cleared, need-to-know access. Every view audit-logged.
CoC and traceability documents are only accessible by the purchasing contractor.
On contract termination, all tenant data is fully purged within 30 days.
Suppliers may request access logs for all accesses to their catalog data.
PWS §02.01.04(e) requires an annual cybersecurity tabletop exercise. FORGE's CloudTrail audit export generates your tabletop documentation package automatically. What used to take weeks takes five minutes.
For FedRAMP package access, NIST SP 800-171 SSP, or security architecture review — contact us.
Contact Security Team →