Two views of one platform: the capability stack and the deployment topology. Identity, records, AI inference, and audit all stay inside your security boundary.
Records, identity, AI inference, workflow, and audit all run inside a single-tenant envelope. Nothing crosses the perimeter without your accredited path.
Read top to bottom, the five layers trace a record’s path: captured at the top, held in the vault, enriched by AI, routed through workflow where a process applies, and reached through the access layer. Identity, audit, and compliance aren’t a sixth layer; they wrap all five.
Connectors · Records API · ETL
Records arrive from the systems agencies already run: prebuilt connectors for M365, Google Workspace, ServiceNow, Salesforce, SAP, Oracle, file shares, email, SMS, and legacy databases, plus the Records API and an ETL lane for bulk migrations. Each record is normalized, hashed, and handed to the vault with its provenance intact.
See Integrations & captureSingle-tenant store · Lifecycle · Holds
A single-tenant store built for federal records. Every record carries a NARA-aligned metadata profile with room for agency-specific fields. Lifecycle services run retention schedules, legal holds, declassification queues, and disposition. The vault is the platform’s source of truth: the substrate every other layer reads from.
Prompt Runner · Model-agnostic
Prompt Runner executes AI operations across the vault at scale. Predefined prompts run continuously against new records or on demand against historical sets. The layer is model-agnostic: it routes inference to whichever model fits the workload and the classification level.
See AI in FeithLow-code · Routing · SLA
A low-code engine that drives any agency process. Workflows trigger on capture events, AI outputs, schedule changes, or user actions. Routing, approvals, escalation chains, and SLA enforcement are all configured visually, with no code deployments.
See Workflow & automationApps · APIs · MCP · Portals
How users and systems reach records: the Feith applications (RMA iQ, FOIA Workbench, Record Insight, Case Manager), public-facing portals, the Records API, and the Feith MCP server. Every path enforces the same role and clearance checks.
Where the logical stack runs in real infrastructure. This is the reference deployment: the same topology runs in commercial cloud, agency cloud, and on-premises datacenters. Component selection follows your standards.
Component selection follows your standards. On AWS GovCloud: DNS via Route 53, load balancing via ELB, RDBMS via RDS, object store via S3, shared file system via EFS. On Azure Government, the native equivalents. On-premises, your existing standards: F5, Oracle, NetApp, and the rest. The topology is identical across all three; only the underlying components differ.
Every Feith deployment is single-tenant. Your records live in your own subnet, inside your boundary, in infrastructure that exists only to serve your mission — never co-mingled with another agency or tenant.
Compute, workflow execution, and AI inference all stay in the same single-tenant envelope. Your data, processing, and metadata never co-mingle with anyone else’s, including Feith’s other customers.
Three options, equal capability. The choice is about where the records sit and who manages the infrastructure underneath.
The full platform inside your datacenter, behind your firewall, wired into your identity, monitoring, and backup. Required for many classified deployments. Full agency control of every layer of infrastructure.
A single-tenant deployment inside the agency’s own cloud subscription, running in compute you already pay for and accredit, with native integration to your cloud identity, key management, and logging.
The fastest path for civilian agencies with FedRAMP Moderate requirements. Feith carries the authorization and the operational burden, so your team focuses on records and workflow, not infrastructure.
All three run the same code, the same APIs, and the same UI. Capability is identical across environments; the choice is about where your records live, not what the platform can do.
Feith is in production across the full federal classification spectrum. Each environment maps to one or more deployment options.
| Environment | Classification | Available on |
|---|---|---|
| NIPRNet | Unclassified | On-premAgency cloud |
| SIPRNet | Secret | On-premAgency cloud |
| JWICS | Top Secret / SCI | On-premAgency cloud |
| AWS GovCloud | CUI (IL4) | Agency cloud |
| AWS Top Secret C2S | Top Secret | Agency cloud |
| Azure Government | CUI | Agency cloudFedRAMP cloud |
| On-premises datacenter | Any | On-prem |
Availability reflects current deployments. Additional environments are supported on request wherever an accreditation path exists.
The same provider authenticates and authorizes a connector capture, a vault read, an AI inference, a workflow approval, and a Records API call — one identity, one audit trail, end to end.
SAML 2.0 and OIDC throughout. Single sign-on with your existing identity provider. Service accounts authenticate through the same federation patterns as interactive users.
Active Directory, Microsoft Entra ID, and LDAP. Group membership drives role assignment; provisioning and deprovisioning flow through the directory, so a user’s access changes the moment their directory record does. No separate Feith user store to keep in sync.
PIV and CAC credentials. Smart-card authentication for interactive sessions.
MFA supported across user and administrative access. FIPS 140-2 and 140-3 validated cryptographic modules throughout. TLS 1.3 in transit, AES-256 at rest. Key management integrates with your KMS or HSM where required.
Role-based access control with attribute extensions for clearance level, compartment, and need-to-know. Every access, action, AI inference, and administrative change writes to a tamper-evident audit log that streams to your SIEM in real time.
The platform is model-agnostic. The orchestration layer routes inference to the model that fits the workload and the classification level. Records never leave the boundary, and they never train external models.
The model comes to the records, not the other way around. Swap models in orchestration config; no re-architecture.
For unclassified workloads, the platform connects to cloud-hosted models from major providers. Inference requests carry your records only as transient context, configured for zero retention — no training, no logging, no retention beyond the call.
For classified and air-gapped workloads, models run entirely inside the accredited boundary — hosted model services inside the enclave, like Azure OpenAI in Azure Government Top Secret, or open-weight models on-premises — with no external connectivity required.
Hybrid deployments route each workload to the right model by classification, sensitivity, and performance. As models improve, you swap them in orchestration, with no re-architecting workflows or applications.
The top-level platform page: capabilities, applications, the ecosystem map. Start here for the broader story.
Platform overviewHow records get into the platform: connectors, the Records API, ETL. The capture layer in detail.
Integrations & captureFedRAMP, FIPS, STIG, CUI and PII enforcement, and the full certification posture. The compliance counterpart to this page.
Security & complianceThe low-code engine that drives agency processes on top of the architecture described here.
Workflow & automationThe AI capabilities running on the orchestration layer: the full AI story.
AI in FeithA demo shows the platform end to end. An architect call goes deep on topology, identity, models, and accreditation paths for your specific environment.
We'll reach out shortly to schedule your demo or architect call.
