Trust Center

The offering

Tarly Cowork is an AI-powered procurement workspace for government acquisition teams. It helps contracting professionals run market research, draft acquisition documents (IGCEs, solicitations, evaluation materials), and manage procurement files with grounded citations to authoritative federal data sources (SAM.gov, USAspending, the FAR and agency supplements).

Service availability

Core Tarly Cowork web and Trust Center endpoints are checked daily from the compliance runner. The resulting status history is published in a public GitHub repository that remains available independently of the Tarly Cowork production request path.

Quarterly review

Public service list & security categories

All services below are included in the planned Tarly Cowork FedRAMP Minimum Assessment Scope and use the offering-wide FIPS 199 Moderate security categorization: confidentiality Moderate, integrity Moderate, and availability Moderate.

Service names below are the names agency users see in the product, so a listing can be checked against Tarly Cowork itself without translation.

Third-party information resources

Third-party information resources within the planned Minimum Assessment Scope, per the FedRAMP 20x Minimum Assessment Scope rules. The machine-readable equivalent is the thirdPartyInformationResources object in fedramp.json.

FedRAMP authorized

Not FedRAMP authorized

Federal use case (Direct Use)

Tarly Cowork is intended for direct use by federal agency customers: agency acquisition personnel use the hosted service as an AI assistant for procurement work — drafting acquisition documents, running market research, and checking compliance with the FAR and agency supplements, with citations back to authoritative federal sources. When an agency places Tarly Cowork in a federal information system, the agency will authorize that use through its Authorization to Operate (ATO) process. A pre-certification pilot with the U.S. Department of Housing and Urban Development (HUD) concluded in August 2026.

Certification roadmap

Current security posture

• Continuous compliance automation. Security evidence is extracted automatically from our infrastructure-as-code, cloud runtime, and vulnerability findings, evaluated against the FedRAMP 20x Key Security Indicator catalog on every code change and nightly, and rendered as the 20x Certification Package Overview, Security Decision Record, and example Ongoing Certification Report. Claims that drift from observed reality fail our CI.
• NIST SP 800-171 & CMMC. Self-assessment completed and filed in SPRS; CMMC Level 2 self-assessment on record.
• Encryption. TLS for all data in transit; AES-256 encryption at rest across databases and storage.
• U.S.-only data residency. All production infrastructure, data, and backups reside in U.S. Azure regions covered by the Azure Commercial FedRAMP High authorization.
• Access control. Production administrative access is restricted through named accounts and least-privilege role assignments; secrets are managed in a dedicated key vault. Phishing-resistant MFA enforcement is tracked as a remediation item ahead of the independent assessment.
• Vulnerability management. Dependency and cloud-security-posture findings are collected automatically on a nightly cycle and tracked through vulnerability remediation records.
• Incident response. Tabletop and after-action evidence is retained; the repository-backed incident response plan is a current certification-package remediation item.
• Security training. Security awareness and role-based training are tracked through quarterly attestations; the current-quarter evidence refresh is in progress.

Architecture & boundary summary

The service boundary consists of managed Azure services in U.S. commercial regions:

Documentation & access

• Trust Center access. The information on this landing page is public — no authentication, registration, or NDA is required. Public information is available from this page and the linked repositories; machine-readable offering data is published at /trust/fedramp.json, and the nightly KSI status has a corresponding JSON report. Agency customers who need documents not published here can request them from the security contact below.
• Programmatic access. Human-readable, JSON, calendar, controlled-bundle, integrity-verification, and access-request instructions are documented in the authenticated Certification Package page, Certification Data Access guide, and machine-readable access manifest.
• Secure configuration guidance. The public Tarly Cowork Secure Configuration Guide explains administrative account lifecycle, least-privilege roles, security-sensitive settings, operating reviews, public sharing precautions, and decommissioning.
• Provider documentation. The Certification Package Overview, Security Decision Record, and Ongoing Certification Reports are maintained by automated evidence collection in CI; NIST SP 800-171 self-assessment (filed in SPRS) and CMMC Level 2 self-assessment are on record. Supporting incident-response evidence and controlled certification materials are available to agency customers on request.
• Supporting package documentation. Authorization boundary, data flows, policies, procedures, assessment evidence, and continuous-compliance results are maintained in human-readable and machine-readable formats. Public summaries appear here; detailed materials are supplied to authorized agency and assessment personnel through the controlled access process.
• Machine-readable documentation overview. The Certification Package Overview at /trust/fedramp.json identifies the public and controlled-access materials, formats, service scope, and access method.
• Significant Change notifications. Tarly uses a single mechanism for every formal Significant Change Notification: notices are supplied to every necessary party through the controlled certification-data distribution channel described in the Certification Data Access guide. Entitled agency and assessment parties can read every change record and notice directly in a browser on the gated Significant Change Notices page, which serves the same controlled bundle behind per-party entitlement credentials. Each notice is retained with its exact bytes and SHA-256, the complete recipient population, one digest-bound delivery receipt per party when delivered, delivery timestamps, and an immutable archive URI and SHA-256. Who may obtain what through that channel, and how to request it, is published in the same guide and its machine-readable pair.
• Reportable-incident notifications. Tarly sends every approved Initial, Ongoing, and Final Incident Report to FedRAMP by email, to every affected agency through its verified agency-specific procedure, and to all necessary parties through an update to the entitlement-gated controlled certification-data channel described in the Certification Data Access guide. The controlled update contains the exact validated human/JSON pair, a signed manifest, file digests, and served-byte verification; recipient and channel receipts are retained per report version. No real reportable incident has occurred, so no real report is currently published.

Pricing

Agency pricing is sized to federal procurement thresholds; usage caps protect cost of service.

Questions: cary@tarly.co.

Progress updates

Updated at least quarterly, per FedRAMP Marketplace continuous-progress requirements (MKT-IIP-DCP).

Recognitions

Tarly has been assessed as Awardable on the Chief Digital and Artificial Intelligence Office (CDAO) Tradewinds Solutions Marketplace, the Department of War's marketplace of post-competition, readily awardable solutions. Our solution video is available to Government Customers on the marketplace (government login required).

Contacts