Tarly Cowork Trust Center
Security and compliance
for Tarly Cowork
Review the service’s security practices, certification progress, and supporting documents.
- Production hosting
- Azure commercial, U.S. regions
- Security evaluations
- Scheduled nightly
- Quarterly reports
- Read the Q3 2026 report
Listing, owner, and overview publication details
FedRAMP status: The Tarly Cowork package has FedRAMP assigned package ID FR2628650874 and is actively preparing for a FedRAMP 20x Certification, Class C (Moderate) certification. An assigned package ID is a registration milestone and does not mean the service is FedRAMP certified. The accountable official is Patrick Phillips, System Owner and FedRAMP Program Owner (security@tarly.co, 585-474-2276). CPO version 2026.10.16.1 was last updated 2026-10-16T19:19:58Z from the Tarly compliance repository source revision. Security and compliance changes are regularly published against below.Reviewing the service?
Start with service scope, data handling, and the current security observations.
Common security questionsReviewing the certification package?
Find reports and assessment materials, explore the current rule packages, or download the complete package after sign-in.
Reviewer starting points and full rule browserFedRAMP 20x KSI status
Review the current result for every Key Security Indicator, including unmet or partially met indicators, check totals, remediation target dates, and evidence-manifest integrity hashes. The independent Git history preserves how Tarly Cowork's reported posture changes over time.
Loading published security observations…
Common security questions
Is Tarly Cowork FedRAMP certified?
Tarly Cowork is preparing for FedRAMP 20x Class C (Moderate) certification. Its assigned package ID and Marketplace Initial Implementation listing are registration milestones. They do not establish certification.
Certification progressWhere does the hosted service run?
Regional production compute, databases, storage, and backups are configured in U.S. Azure commercial regions. Global edge, DNS, and identity services are separately identified in the service inventory.
Architecture summaryWhich product and deployment does this cover?
The hosted Tarly Cowork offering at gov.tarly.co. Tarly Scanner and alternative deployment models have separate scope and are not included in this Marketplace listing.
Included services and security categoriesHow do I get the assessment, reports, or evidence?
Approved reviewers can browse by security rule, read individual documents, or download the full package.
Request reviewer access · Sign-in and access guideOffering identity and listing details
The offering
Tarly Cowork is an AI-powered procurement workspace for government acquisition teams. It helps contracting professionals run market research, draft acquisition documents (IGCEs, solicitations, evaluation materials), and manage procurement files with grounded citations to authoritative federal data sources (SAM.gov, USAspending, the FAR and agency supplements).
Service availability
Loading published daily observations…
Core Tarly Cowork web and Trust Center endpoints are checked daily from the compliance runner. The resulting status history is published in a public GitHub repository that remains available independently of the Tarly Cowork production request path.
Evidence-backed daily availability monitoring began August 8, 2026. The Class C requirement for a rolling 30-day history is available; the retained series continues to grow with each daily observation. The publisher records current service state, daily history, and derived availability incidents in both human-readable Markdown and machine-readable JSON.
Quarterly review
The next synchronous Tarly Cowork FedRAMP Quarterly Review, covering Q4 2026, is targeted for January 13, 2027 at 3:00 p.m. Eastern, following the January 6 OCR target. Necessary parties may register by email or download the calendar file. Connection details will be supplied to registered necessary parties.
The Q3 2026 review was held October 13, 2026. Authorized necessary parties can sign in to download the slides, reviewed recording, transcript and meeting record. The review occurred one business day after the October 12 OCR publication; the disclosed timing exception remains on record.
Questions and feedback on an Ongoing Certification Report may be submitted asynchronously to the Tarly security team. Feedback is desensitized and summarized in the subsequent report.
The initial Q3 2026 Ongoing Certification Report was published October 12, 2026 and covers July 17 through October 12. It includes all eight required report sections, the current results, open findings, and an anonymized feedback addendum. Authorized necessary parties can sign in to read or download the OCR in PDF, Markdown and JSON. Report content requires authenticated Trust Center access. The next regular OCR, covering Q4 2026, is targeted for January 6, 2027.
Included services and security categories
Public service list & security categories
All services below are included in the planned Tarly Cowork FedRAMP Minimum Assessment Scope and use the offering-wide FIPS 199 Moderate security categorization: confidentiality Moderate, integrity Moderate, and availability Moderate.
Service names below are the names agency users see in the product, so a listing can be checked against Tarly Cowork itself without translation.
| Included service | Function | Available since | Security category |
|---|---|---|---|
| Conversations | The AI procurement assistant: citation-grounded acquisition research, FAR and agency-supplement analysis, and document drafting, over uploaded evidence, connected sources, authoritative federal data, and read-only fetches of public web pages. Includes explicit, revocable share links for individual conversations (since March 19, 2026). | 2026-03-13 | FIPS 199 Moderate C: M · I: M · A: M |
| Procurement Files | The system of record for an acquisition: overview and contract data, conversations, artifacts, sources and evidence, reviews, membership and access, and an append-only audit log, with role-based privileges enforced per file. | 2026-03-13 | FIPS 199 Moderate C: M · I: M · A: M |
| Workflows | Guided, multi-step acquisition workflows producing market research, IGCEs, solicitations, and evaluation materials, with versioning, validation, and export to Word and PDF. | 2026-03-13 | FIPS 199 Moderate C: M · I: M · A: M |
| Resources | The customer-managed reference library plus the indexed corpus of the FAR, agency supplements, and document templates the assistant retrieves and cites from. | 2026-03-13 | FIPS 199 Moderate C: M · I: M · A: M |
| Workspace | Isolated execution environment for reading and writing working files and analyzing customer-supplied evidence. Scoped to one procurement file or conversation, in a dedicated sandbox container with no direct database access and only its own storage share mounted. | 2026-05-12 | FIPS 199 Moderate C: M · I: M · A: M |
| Approval Paths | Administrator-defined review and approval routing for procurement files and artifacts, with per-step assignment, approval state, and audit history. | 2026-07-29 | FIPS 199 Moderate C: M · I: M · A: M |
Supplemental information — outside Tarly Cowork and not FedRAMP Certified:
The items below are clearly separated from the Tarly Cowork cloud service offering and its Minimum Assessment Scope. They are provided only to prevent product-name or deployment-model ambiguity; none is claimed as included in, assessed with, or FedRAMP Certified as part of Tarly Cowork.
- Tarly Scanner at tarly.co is a separate public procurement-opportunity scanning product.
- Unconnected development, test and corporate business workloads are excluded only when they neither process federal customer data nor administer, build, test, sign, deploy or publish evidence for production. Production delivery, staging verification and evidence-publishing dependencies remain in supporting assessment scope.
- Alternative deployment models, including customer-hosted, on-premises, and Azure Government deployments, are not included in this Marketplace listing or planned Minimum Assessment Scope.
Federal use case (Direct Use)
Tarly Cowork is intended for direct use by federal agency customers: agency acquisition personnel use the hosted service as an AI assistant for procurement work — drafting acquisition documents, running market research, and checking compliance with the FAR and agency supplements, with citations back to authoritative federal sources. When an agency places Tarly Cowork in a federal information system, the agency will authorize that use through its Authorization to Operate (ATO) process. A pre-certification pilot with the U.S. Department of Housing and Urban Development (HUD) concluded in August 2026.
Certification progress
FedRAMP 20x Class C (Moderate) certification is in progress.
| Date | Milestone | Status |
|---|---|---|
| NIST SP 800-171 self-assessment completed and filed in the Supplier Performance Risk System (SPRS). | ✓ Complete | |
| FedRAMP Marketplace Initial Implementation listing approved; package ID FR2628650874 assigned. | ✓ Complete | |
| Gap remediation and machine-readable evidence package completed under the FedRAMP 20x Consolidated Rules 2026 (CR26) guidelines to support the Class C assessment and submission. | ✓ Complete | |
| Independent 3PAO assessment completed by A-LIGN for FedRAMP 20x Class C (Moderate); updated results and clarification received September 11. | ✓ Complete | |
| – | Q3 OCR and quarterly review completed. The report covers July 17–October 12 and was published October 12. | ✓ Complete |
Quarterly report · Meeting materials — authenticated Trust Center access required.
Current security posture
- Continuous compliance automation. Security evidence is extracted automatically from our infrastructure-as-code, cloud runtime, and vulnerability findings, evaluated against the FedRAMP 20x Key Security Indicator catalog through static checks on changes and operational evaluation nightly and on demand. The published results include partially met indicators and open remediation work; automated checks support the review of the Certification Package Overview, Security Decision Record and Ongoing Certification Report.
- NIST SP 800-171 & CMMC. Self-assessment completed and filed in SPRS; CMMC Level 2 self-assessment on record.
- Encryption. Public application connections use TLS, and managed databases and storage use AES-256 encryption at rest. Service-to-service paths and cryptographic implementation limitations are documented in the controlled boundary review.
- Data residency. Regional production compute, databases, storage and backups are configured in U.S. Azure regions. Global edge, DNS and identity services are separately identified in the service inventory.
- Access control. Production administrators use named accounts and time-bound PIM activation for subscription Owner access. Standing resource-level grants and lifecycle exceptions remain under review. Secrets are managed in Key Vault; automated checks examine the phishing-resistant MFA policy and eligible privileged-account coverage.
- Vulnerability management. Dependency and cloud-security-posture findings are collected automatically on a nightly cycle and tracked through vulnerability remediation records.
- Incident response. Tabletop and after-action evidence is retained; the repository-backed incident response plan and exercise records are included in the controlled certification package.
- Security training. Security awareness and role-based training are tracked through quarterly attestations, with completion and freshness checked against the current personnel population.
Architecture and boundary detail
Architecture & boundary summary
The service boundary consists of managed Azure services in U.S. commercial regions:
Documentation & access
Certification package (sign-in required)
Browse the current security-rule packages after sign-in. Authorization boundary, data flows, policies, procedures, assessment evidence, and supporting records are available as individual documents, rule ZIPs, or the complete package.
This overview is public. Detailed evidence and assessment materials require approved access.
- Access and API guides. Certification Data Access Guide · API instructions and token management · Machine-readable access manifest.
- Service documentation. Certification Package Overview (JSON) · Secure Configuration Guide.
- Significant Change notifications. Supplied to necessary parties through the controlled certification-data channel. Read change notices.
- Reportable-incident notifications. Report recipients, delivery channels, and access policy.
Contacts
Security researchers: please report vulnerabilities to security@tarly.co with "SECURITY" in the subject line.