Tarly · Secure Configuration Guide Trust Center →

Tarly Cowork Secure Configuration Guide

Recommended security configuration for agency administrators and privileged users of the Tarly Cowork SaaS offering.

FedRAMP package ID: FR2628650874

Version 1.2 · Published July 17, 2026 · Updated August 17, 2026 · Owner: Tarly Security

1. Administrative account model

Tarly Cowork uses two administrative layers:

• Platform administrator: a top-level Tarly-controlled account that can perform cross-workspace, read-only support and security review. Platform administrators are configured outside the customer interface, limited to an approved allowlist, and their review access is audit logged.
• Procurement-file administrator: the Admin or Contracting Officer (CO) role for a specific procurement file. These roles control that file's membership and have broad access to its conversations, evidence, artifacts, audit records, and exports.

No customer user may self-promote to platform administrator. Procurement-file roles may be changed only by a member with the members:manage permission.

2. Securely provision and access administrative accounts

1. Designate named individuals; never use shared or group credentials.
2. Use an agency-controlled email address and an agency-approved device.
3. Request platform-level access in writing from Tarly Security. Include the person's name, agency, official role, business need, approving official, requested duration, and whether access is emergency or routine.
4. For procurement-file access, start with the least-privileged role in the matrix below. Assign Admin or CO only when the user must manage membership or modify all file content.
5. Use agency-approved federated sign-in when it has been configured for the deployment. For password-based access, use a unique password of at least 15 characters stored in an approved password manager.
6. Do not begin processing federal information until required agency authentication controls have been confirmed with Tarly Security.
7. Verify the system-use notification and production hostname (https://gov.tarly.co) before signing in.

3. Recommended least-privilege roles

4. Security-sensitive settings and operations

Settings reserved to the top-level platform administrator

Membership and role changes

• Confirm the recipient's identity, agency affiliation, need to know, and required role before adding them.
• Review membership at least quarterly and whenever personnel, contract, or organizational responsibilities change.
• Remove access promptly when it is no longer required. Member additions, role changes, and removals are written to the file audit log.

Public conversation sharing

• A shared-conversation link is accessible without sign-in to anyone who possesses the link. It may expose the selected conversation and associated procurement-file artifacts and evidence.
• Do not create a public share for CUI, source-selection information, procurement-sensitive information, PII, credentials, or any material not approved for public release.
• Before sharing, inspect the entire conversation plus its visible evidence and artifacts. Remove an existing link with Share → Remove share link. If it cannot be removed immediately, contact Tarly Security.

Evidence, external data, and exports

• Upload only information authorized for the procurement file and confirm source rights and handling markings.
• Treat generated output as a draft. Validate claims, citations, clauses, calculations, and required approvals before official use.
• Store downloaded exports only in agency-approved repositories and apply the original information's markings, access controls, and retention rules.

Platform-administrator review

Platform-administrator access can expose customer conversations and procurement-file content in a read-only support view. Tarly restricts this capability to approved administrators and records transcript and file review events. Agencies should require a documented support or security purpose before requesting such access.

5. Operating review checklist

• Confirm every user is active, individually identified, and still has a business need.
• Confirm Admin and CO assignments remain necessary and all other users have the least-privileged suitable role.
• Review the procurement-file audit log for unexpected membership, role, and privileged-access events.
• Review public share decisions and immediately report any unintended disclosure.
• Confirm exported materials remain in approved agency storage.
• Report suspected account compromise or anomalous activity to Tarly Security without delay.

6. Decommissioning

1. Remove the user from every procurement file when access is no longer required. This immediately removes authorization to those files. For organization-wide separation, also request account disablement from Tarly Security; procurement-file removal alone does not end access to other files where the user remains a member.
2. For platform administrators, send a written removal request to Tarly Security; Tarly removes the account from the administrator allowlist and confirms completion.
3. Transfer accountable CO ownership before removing the departing CO.
4. Inventory and disposition agency-held exports according to agency records schedules and information-handling policy.
5. For full tenant or procurement-file closure, send an authorized data-removal request identifying the scope and required deadline. Tarly will confirm removal and any applicable backup-retention period.

7. Incident and support contacts

8. Machine-readable guide and enhancement capabilities

The machine-readable baseline is available at /trust/secure-configuration-guide.json. It supplies stable setting identifiers, recommended values, comparison operators, current-value sources, provisioning defaults, and explicit capability limitations. A value that cannot be observed must be reported as not-observable; it must not be assumed compliant.

• API capability is available, within a customer's scope. Authorized file managers can list and adjust procurement-file membership roles through the application API, users can manage their own passkeys, and any authenticated caller can read and compare all effective security settings in their scope. The platform-administrator allowlist and the global MFA and session policy sit outside that scope by design: they are platform-wide policy rather than one customer's setting, and a customer API able to change them would let one tenant weaken the posture every tenant relies on. The provider makes those changes on request to security@tarly.co.
• Complete comparison is available. GET /api/security-settings/comparison returns every setting in this guide next to its observed current value, using the operator published with that setting. Scope follows the caller: a platform administrator sees the administrator settings, and any caller sees the procurement files they manage. A setting that cannot be observed is returned as not-observable and clears summary.complete; it is never assumed to match.
• Complete export is available. GET /api/security-settings/export returns all effective security settings in the caller's scope as JSON — effective platform policy, the platform-administrator roster with passkey enrollment, privileged procurement-file membership, and public conversation sharing. Add ?download=1 for a file. Ordinary procurement artifact, evidence, and document exports remain separate and are not a security-configuration export.
• Platform changes remain controlled. Contact security@tarly.co for platform-administrator review or changes.

9. Revision history