Two views of one platform: the capability stack and the deployment topology. Identity, records, AI inference, and audit all stay inside your security boundary. Written for the IT, security, and architecture teams evaluating Feith on the merits.
AI inference runs against your records in place, with no training and no retention. Nothing crosses the perimeter without your accredited path.
Read top to bottom, the five layers trace a record’s path: captured at the top, held in the vault, enriched by AI, driven through workflow, and reached through the access layer. Identity, audit, and compliance aren’t a sixth layer; they wrap all five.
Connectors · Records API · ETL
Records arrive from the systems agencies already run: prebuilt connectors for M365, Google Workspace, ServiceNow, Salesforce, SAP, Oracle, file shares, email, SMS, and legacy databases, plus the Records API and an ETL lane for bulk migrations. Each record is normalized, hashed, and handed to the vault with its provenance intact.
See Integrations & captureSingle-tenant store · Lifecycle · Holds
A single-tenant store built for federal records. Every record carries a NARA-aligned metadata profile with room for agency-specific fields. Lifecycle services run retention schedules, legal holds, declassification queues, and disposition. The vault is the platform’s source of truth: the substrate every other layer reads from.
Prompt Runner · Model-agnostic
Prompt Runner executes AI operations across the vault at scale. Predefined prompts run continuously against new records or on demand against historical sets. The layer is model-agnostic: it routes inference to whichever model fits the workload and the classification level.
See AI in FeithLow-code · Routing · SLA
A low-code engine that drives any agency process. Workflows trigger on capture events, AI outputs, schedule changes, or user actions. Routing, approvals, escalation chains, and SLA enforcement are all configured visually, with no code deployments.
See Workflow & automationApps · APIs · MCP · Portals
How users and systems reach records: the Feith applications (RMA iQ, FOIA Workbench, Record Insight, Case Manager), public-facing portals, the Records API, and the Feith MCP server. Every path enforces the same role and clearance checks.
Identity, audit, and compliance wrap all five layers. Every layer reads from one identity provider, writes to one audit log, and inherits one compliance posture.
Where the logical stack runs in real infrastructure. This is the reference deployment: the same topology runs in commercial cloud, agency cloud, and on-premises datacenters. Component selection follows your standards.
Component selection follows your standards. On AWS GovCloud: DNS via Route 53, load balancing via ELB, RDBMS via RDS, object store via S3, shared file system via EFS. On Azure Government, the native equivalents. On-premises, your existing standards: F5, Oracle, NetApp, and the rest. Same topology, same code, same APIs.
Every Feith deployment is single-tenant: no shared compute, no shared database, no shared storage with other agencies or tenants. Your records live in your subnet, inside your boundary, in infrastructure that exists only to serve your mission.
AI inference happens against your records inside that boundary, and results flow back into your vault. Workflow execution stays in the same envelope. Your data, processing, and metadata never co-mingle with anyone else’s, including Feith’s other customers.
Three options, equal capability. The choice is about where the records sit and who manages the infrastructure underneath.
The full platform inside your datacenter, behind your firewall, wired into your identity, monitoring, and backup. Required for many classified deployments. Full agency control of every layer of infrastructure.
A single-tenant deployment inside the agency’s own cloud subscription, running in compute you already pay for and accredit, with native integration to your cloud identity, key management, and logging.
The fastest path for civilian agencies with FedRAMP Moderate requirements. Feith carries the authorization and the operational burden, so your team focuses on records and workflow, not infrastructure.
All three run the same code, the same APIs, and the same UI. Capability is identical across environments; the choice is about where your records live, not what the platform can do.
Feith is in production across the full federal classification spectrum. Each environment maps to one or more deployment options.
| Environment | Classification | Available on |
|---|---|---|
| NIPRNet | Unclassified | On-premAgency cloudFedRAMP cloud |
| SIPRNet | Secret | On-premAgency cloud |
| JWICS | Top Secret / SCI | On-premAgency cloud |
| AWS GovCloud (Moderate) | CUI | Agency cloudFedRAMP cloud |
| AWS GovCloud (High) | IL5 | Agency cloud |
| AWS Top Secret C2S | Top Secret | Agency cloud |
| Azure Government | CUI / IL5 | Agency cloud |
| On-premises datacenter | Any | On-prem |
Availability reflects current deployments. Additional environments are supported on request wherever an accreditation path exists.
Identity isn’t a layer; it’s a cross-cutting service inside every layer above it. The same provider authorizes a connector capture, a vault read, an AI inference, a workflow approval, and a Records API call.
SAML 2.0, OIDC, and OAuth 2.0 throughout. Single sign-on with your existing identity provider. Service accounts authenticate through the same federation patterns as interactive users.
Active Directory, Microsoft Entra ID, and LDAP. Group membership drives role assignment; provisioning and deprovisioning flow through the directory, so a user’s access changes the moment their directory record does. No separate Feith user store to keep in sync.
PIV, CAC, and PIV-Interoperable credentials. Smart-card authentication for interactive sessions; certificate-based authentication for service accounts and machine-to-machine integrations. Compatible with the federal PKI common policy framework.
MFA enforced on every access path. FIPS 140-2 and 140-3 validated cryptographic modules throughout. TLS 1.3 in transit, AES-256 at rest. Key management integrates with your KMS or HSM where required.
Role-based access control with attribute extensions for clearance level, compartment, and need-to-know. Every access, action, AI inference, and administrative change writes to a tamper-evident audit log that feeds your SIEM over standard syslog or API ingestion.
The platform is model-agnostic. The orchestration layer routes inference to the model that fits the workload and the classification level. Records never leave the boundary, and they never train external models.
Records never cross the boundary: the model comes to the records. Swap models in orchestration config; no re-architecture.
For unclassified workloads, the platform connects to cloud-hosted models from major providers. Inference requests carry your records only as transient context, with no training, no logging, no retention beyond the call.
For classified and air-gapped workloads, the platform runs open-weight models on-premises or inside accredited cloud enclaves. They operate entirely inside your security boundary, with no external connectivity required.
Hybrid deployments route each workload to the right model by classification, sensitivity, and performance. As models improve, you swap them in orchestration, with no re-architecting workflows or applications.
The top-level platform page: capabilities, applications, the ecosystem map. Start here for the broader story.
Platform overviewHow records get into the platform: connectors, the Records API, ETL. The capture layer in detail.
Integrations & captureFedRAMP, FIPS, STIG, CUI and PII enforcement, and the full certification posture. The compliance counterpart to this page.
Security & complianceThe low-code engine that drives agency processes on top of the architecture described here.
Workflow & automationThe AI capabilities running on the orchestration layer: the full AI story.
AI in FeithA demo shows the platform end to end. An architect call goes deep on topology, identity, models, and accreditation paths for your specific environment.
Feith engineering will reach out within one business day to schedule your demo or architect call.
