Feith is FedRAMP Moderate Authorized → Read the release
Feith

Built to run inside your boundary.

Identity, records, AI inference, and audit all stay inside your security boundary.

Book a demo Talk to a Feith architect
3 deployment optionsOn-prem · agency cloud · FedRAMP cloud
7 operating environmentsNIPRNet to AWS Top Secret C2S
100% single-tenantNo shared compute, database, or storage

Five layers. One platform.

A record is captured, held in the vault, enriched by AI, routed through workflow where a process applies, and reached through the access layer. Identity and compliance controls wrap all five.

Identity · audit · compliance · wraps every layer
L1
Capture layer Connectors, Records API, ETL, federation, normalization
L2
Records vault Single-tenant store, lifecycle services, holds, retention
L3
AI orchestration Prompt Runner, model-agnostic inference, scheduled execution
L4
Workflow engine Low-code automation, routing, escalation, SLA enforcement
L5
Access layer Applications, APIs, MCP, portals, dashboards

What each layer does.

Capture layer

Connectors · Records API · ETL

Records arrive from the systems agencies already run: prebuilt connectors for M365, Google Workspace, ServiceNow, Salesforce, SAP, Oracle, file shares, email, SMS, and legacy databases, plus the Records API and an ETL lane for bulk migrations. Each record is normalized, hashed, and handed to the vault with its provenance intact.

See Integrations & capture

Records vault

Single-tenant store · Lifecycle · Holds

A single-tenant store built for federal records. Every record carries a NARA-aligned metadata profile with room for agency-specific fields. Lifecycle services run retention schedules, legal holds, declassification queues, and disposition. The vault is the platform’s source of truth: the substrate every other layer reads from.

AI orchestration

Prompt Runner · Model-agnostic

Prompt Runner executes AI operations across the vault at scale. Predefined prompts run continuously against new records or on demand against historical sets. The layer is model-agnostic: it routes inference to whichever model fits the workload and the classification level.

See AI in Feith

Workflow engine

Low-code · Routing · SLA

A low-code engine that drives any agency process. Workflows trigger on capture events, AI outputs, schedule changes, or user actions. Routing, approvals, escalation chains, and SLA enforcement are all configured visually, with no code deployments.

See Workflow & automation

Access layer

Apps · APIs · MCP · Portals

How users and systems reach records: the Feith applications (RMA iQ, FOIA Workbench, Record Insight, Case Manager), public-facing portals, the Records API, and the Feith MCP server. Every path enforces the same role and clearance checks.

One topology, any infrastructure.

The same topology runs in commercial cloud, agency cloud, and on-premises datacenters. Component selection follows your standards.

Edge External services, outside the security boundary
Internet
DNS
Load balancer
Identity provider
Secure remote access
Cloud or datacenter container Your cloud subscription or on-prem datacenter
Single-tenant private subnet Inside the boundary
Web application server L5 access ingress
Application server L2–L4 platform logic
Full-text search server Index over the vault
Storage layer Inside the container, outside the subnet
Relational database
Object storage
Shared file system
Mail service Outbound notification routing, inside the container

Component selection follows your standards. The relational database is Oracle or SQL Server, and content storage is local disk, Amazon S3, Microsoft Azure, or Google Cloud Storage, set per volume by configuration. The platform delivers the same capabilities in all three; only the underlying components differ.

Your records. Your subnet.

Every Feith deployment is single-tenant. Your records live in your own subnet, inside your boundary, in infrastructure that exists only to serve your mission and is never co-mingled with another agency or tenant.

Shared-tenant

Agency AAgency BYouAgency D
Shared database Shared storage
  • Co-mingled compute
  • Shared database, shared storage
  • Noisy-neighbor performance
  • Vendor-imposed maintenance windows

Single-tenant

Your agency
Your database Your storage
  • Infrastructure-level isolation
  • Dedicated database, dedicated storage
  • Predictable, dedicated performance
  • Maintenance on your schedule

Compute, workflow execution, and AI inference all stay in the same single-tenant envelope. Your data, processing, and metadata never co-mingle with anyone else’s, including Feith’s other customers.

Deploy where the work lives.

Three options, equal capability. The choice is about where the records sit and who manages the infrastructure underneath.

On-premises

Where it runs
Your datacenter, your hardware
Who manages what
You manage the infrastructure. Feith supports the platform with resources on-site.
Environments
NIPR · SIPR · JWICS
Time to deploy
Timeline driven by your accreditation process
HA / DR
Your HA and DR stack, to your RPO and RTO

The full platform inside your datacenter, behind your firewall, wired into your identity, monitoring, and backup. Required for many classified deployments. Full agency control of every layer of infrastructure.

Agency cloud

Where it runs
Your cloud subscription (AWS GovCloud, Azure Government, AWS TS C2S, others)
Who manages what
You manage the cloud account, identity, and infrastructure. Feith supports the platform and supplies your ATO artifacts.
Environments
AWS GovCloud · Azure Gov · AWS TS C2S
Time to deploy
Timeline driven by your accreditation process
HA / DR
High availability and disaster recovery configured to your requirements

A single-tenant deployment inside the agency’s own cloud subscription, running in compute you already pay for and accredit, with native integration to your cloud identity, key management, and logging.

Feith FedRAMP cloud

Where it runs
Feith’s FedRAMP Moderate authorized cloud
Who manages what
Feith manages infrastructure and platform. You manage records, users, and workflows.
Environments
FedRAMP Moderate
Time to deploy
The fastest path: an Authority to Use on the existing FedRAMP package
HA / DR
High availability and disaster recovery managed by Feith

The fastest path for civilian agencies with FedRAMP Moderate requirements. Feith carries the authorization and the operational burden, so your team focuses on records and workflow, not infrastructure.

All three run the same code, the same APIs, and the same UI. Capability is identical across environments.

Seven environments. One platform.

Feith is in production across the full federal classification spectrum. Each environment maps to one or more deployment options.

Environment Classification Available on
NIPRNet Unclassified
On-premAgency cloud
SIPRNet Secret
On-premAgency cloud
JWICS Top Secret / SCI
On-premAgency cloud
AWS GovCloud CUI (IL4)
Agency cloud
AWS Top Secret C2S Top Secret
Agency cloud
Azure Government CUI
Agency cloudFedRAMP cloud
On-premises datacenter Any
On-prem

Availability reflects current deployments. Additional environments are supported on request wherever an accreditation path exists.

Identity runs through every layer.

The same provider authenticates and authorizes a connector capture, a vault read, an AI inference, a workflow approval, and a Records API call. One identity, one audit trail, end to end.

Federation

SAML 2.0OIDC

SAML 2.0 and OIDC throughout. Single sign-on with your existing identity provider.

Directory integration

Active DirectoryEntra IDLDAP

Active Directory, Microsoft Entra ID, and LDAP. Group membership drives role assignment; provisioning and deprovisioning flow through the directory, so a user’s access changes the moment their directory record does. No separate Feith user store to keep in sync.

Federal PKI

PIVCAC

PIV and CAC credentials. Smart-card authentication for interactive sessions.

Multi-factor and cryptography

MFAFIPS 140-2/3TLS 1.3AES-256

MFA supported across user and administrative access. FIPS 140-2 and 140-3 validated cryptographic modules where required. TLS 1.3 in transit, AES-256 at rest. Key management integrates with your KMS or HSM where required.

Access control and logging

RBAC + ABACTamper-evident logSIEM forwarding

Role-based access control with attribute extensions for clearance level, compartment, and need-to-know. Every access, action, AI inference, and administrative change writes to a tamper-evident log that streams to your SIEM in real time.

Any model. Your boundary.

The platform is model-agnostic. The orchestration layer routes inference to the model that fits the workload and the classification level. Records stay in your own vault, and they never train external models.

Cloud-hosted Anthropic · OpenAI (Azure) · AWS Bedrock · Google Vertex
Open-weight Llama-family · Mistral · others (swappable)
Unclassified
Routed
Routed
CUI (IL4)
Routed, agency policy
Routed
Secret (IL6)
Not available
On-prem or enclave
Top Secret / SCI (IL7)
Inside the accredited enclave
Air-gapped

The model comes to the records, not the other way around. Swap models in orchestration config; no re-architecture.

Unclassified

For unclassified workloads, the platform connects to cloud-hosted models from major providers. Inference requests carry your records only as transient context, configured for zero retention: no training, no logging, no retention beyond the call.

Classified · air-gapped

For classified and air-gapped workloads, models run entirely inside the accredited boundary with no external connectivity required: hosted model services inside the enclave, like Azure OpenAI in Azure Government Top Secret, or open-weight models on-premises.

Hybrid

Hybrid deployments route each workload to the right model by classification, sensitivity, and performance. As models improve, you swap them in orchestration, with no re-architecting workflows or applications.

Explore the rest of the platform.

Platform overview

Capabilities, applications, and the ecosystem map.

Platform overview

Integrations & capture

How records get into the platform: connectors, the Records API, ETL.

Integrations & capture

Security & compliance

FedRAMP, FIPS, STIG, CUI and PII enforcement, and the full certification posture.

Security & compliance

Workflow & automation

The low-code engine that drives agency processes.

Workflow & automation

AI in Feith

The AI capabilities running on the orchestration layer.

AI in Feith

See it in your environment.

Prefer to read first? Security & compliance Integrations & capture
Book a demo or an architect call