Your pursuits, Personnel and past performance are competitive information. GovBrain protects them with required multi-factor sign-in, strict team isolation and an AI assistant that can read but never change your records. Our controls are mapped to FedRAMP 20x Class C and SOC 2.
Frameworks
We use two public frameworks as the yardstick for our own controls: the Key Security Indicators FedRAMP sets for Class C (Moderate) cloud services, and the AICPA Trust Services Criteria behind SOC 2.
FedRAMP 20x
46 Key Security Indicators in 10 areas, covering identity and access, cloud architecture, change management, logging, incident response and recovery planning.
Areas from the FedRAMP Consolidated Rules for 2026
SOC 2
The AICPA criteria behind SOC 2 reports, covering security, availability, processing integrity, confidentiality and privacy. Below are the common criteria our day-to-day controls answer most directly.
Criteria from the AICPA Trust Services Criteria (2017, revised 2022)
Self-assessed, not certified. GovBrain is not FedRAMP certified and has not completed a SOC 2 examination by an independent auditor. We assess our controls against both frameworks ourselves, and we are glad to walk your security team through the mapping.
Ask for a walkthroughDefense in depth
Each layer has its own controls, so no single one has to hold on its own.
FedRAMP 20xCNA · CMTSOC 2CC8
FedRAMP 20xIAMSOC 2CC6
FedRAMP 20xIAM · CNASOC 2CC6
FedRAMP 20xSVCSOC 2CC6 · C1
Your dataPursuits, Personnel, projects and past performance
Responsible AI
Brian helps your team write and fit documents. It works inside your team’s scope, can read your records but never change them, and every edit it makes in the editor can be undone.
Read your team’s recordsRead-only access
AllowedEdit the document you have openEvery AI edit can be undone
UndoableChange your recordsIt cannot write to them
NeverSave on your behalfNothing saves until you do
NeverLook outside your teamLookups always use your team’s scope
NeverHave its requests stored by the AI providerBrian sends them with storage turned off
OffFAQ
Something we didn’t cover? Email the team and we’ll get back within a business day.
Not at this time. GovBrain is not FedRAMP certified and has not completed a SOC 2 examination. We map our controls to the FedRAMP 20x Class C Key Security Indicators and the SOC 2 Trust Services Criteria, assess ourselves against both, and are glad to walk your security team through that mapping.
The application, files and sign-in run on Amazon Web Services in the United States, and records are stored in a managed MongoDB Atlas database. Releases are built, scanned and deployed by an automated pipeline that uses short-lived credentials.
Only members of your team. Every record, file and form is scoped to your team, members join by invitation, and file access is checked against your team before a download link is issued.
Multi-factor authentication is required on every account, with an authenticator app or a passkey. SMS codes are not used, passwords must be at least 12 characters, and signed tokens are verified on every signed-in request.
Through a private upload link that expires after the period you set, up to 30 days. Partners add their own Personnel and projects without an account, and GovBrain stores only a hash of each link’s secret token.
No. Brian has read-only access to your records. Its edits apply to the document you have open, nothing saves until you do, and every edit can be undone.
Dependencies are updated weekly, automated checks fail on high or critical advisories, every change is scanned for leaked secrets across the code history, and container images are scanned on every release. If you find an issue, report it using the details at the bottom of this page.
Responsible disclosure
If you believe you have found a security issue in GovBrain, email hello@govbrain.org with the details. We acknowledge reports promptly and ask that you give us a reasonable time to fix an issue before disclosing it.