VirtualDojo Trust CenterCompliance & certifications
FedRAMP 20x and SOC 2 are both in progress; neither has been awarded yetFedRAMP 20x Certification (Class C)
In Progress
Program path; Consolidated Rules for 2026
SOC 2 (Security / Common Criteria)
In Progress
Type II, Security scope; independent CPA examination
The FedRAMP 20x Key Security Indicators are derived from the NIST SP 800-53 Rev 5 Moderate baseline. This reflects the scope of an in-progress FedRAMP Certification and is not itself a separate certification.
Cloud service offering
Public information- Offering
- VirtualDojo AI CRM
- Provider
- VirtualDojo, Inc.
- UEI
- JZCAH18DEDC8
- CAGE
- 142E1
- Category
- Customer Relationship Management
- Website
- https://virtualdojo.com
VirtualDojo AI CRM is a cloud-based customer relationship management platform with AI-powered proposal generation, contact management, pipeline forecasting, and document automation. The platform is designed for government contractors and federal agencies managing procurement workflows, storing Controlled Unclassified Information (CUI) including government contract data, customer PII, proposal documents, and financial/pricing data.
- Security contact
- Devin Henderson · security@virtualdojo.com
- Sales contact
- Cyrus Calloway · cyrus@virtualdojo.com
- Assessor
- Anthony Timbers LLC · FedRAMP-recognized 3PAO (#203181)
Services & security categories
Services in the FedRAMP assessment scope| Service | Confidentiality | Integrity | Availability | In scope |
|---|---|---|---|---|
Contact & Account Management CRM contact records, account hierarchies, activity tracking |
Moderate | Moderate | Moderate | Yes |
AI Proposal Generation AI-powered proposal drafting using Google Vertex AI |
Moderate | Moderate | Low | Yes |
Pipeline & Forecasting Sales pipeline management, revenue forecasting, analytics |
Moderate | Moderate | Low | Yes |
Document Management Proposal documents, quotes, attachments stored in GCS |
Moderate | Moderate | Moderate | Yes |
Tenant Administration Multi-tenant provisioning, user management, RBAC |
Moderate | High | Moderate | Yes |
Customer Support Portal (support.virtualdojo.com) Salesforce Experience Cloud site, fronted by Cloudflare, holding product documentation and customer support requests. It is NOT part of the FedRAMP Minimum Assessment Scope, runs outside the Assured Workloads perimeter, and is NOT authorized for Controlled Unclassified Information or federal customer data. Content reaches it only when a person submits a support request. Submitting CUI or federal customer data through it is prohibited by the VirtualDojo Rules of Behavior; this is an administrative control, not a technical one. Use of this portal is optional and is not required to use VirtualDojo AI CRM. |
None | None | None | No |
Corporate Website (virtualdojo.com, www.virtualdojo.com) Public marketing and product information website, hosted on Wix. It is NOT part of the FedRAMP Minimum Assessment Scope. It handles no federal customer data and provides no access to the CRM. |
None | None | None | No |
Development Environment (dev.virtualdojo.com, portal.virtualdojo.com) Non-production development deployment of the platform. portal.virtualdojo.com is a historical DNS alias (CNAME) for this environment and is not a separate system or a customer portal. Neither name is part of the FedRAMP Minimum Assessment Scope, neither is offered to customers, and neither stores, processes or transmits federal customer production data. |
None | None | None | No |
Security & availability
continuous monitoringContinuous control monitoring
46 Key Security Indicators continuously monitored · last validated 2026-10-22
Service availability
99.98%rolling 30-day, measured
30 days agoToday
Measured by Google Cloud uptime checks (5-minute interval) on app.virtualdojo.com. Machine-readable in public_info.json.
Privacy & data
data protection & residency- Privacy Policy
- Privacy Policy
- Impact level
- Moderate (CUI)
Data residency
All customer data stays in the United States, inside the Google Cloud Assured Workloads FedRAMP Moderate boundary.
us-central1
Iowa · Primary region
Cloud Run compute, most Vertex AI inference, the AlloyDB primary, Memorystore Redis, Secret Manager, and the primary application services. All encrypted with customer-managed keys (CMEK).
us (multi-region)
United States · Storage and batch AI
Durable object storage (Cloud Storage US multi-region) and the CUI-classifier batch jobs on Vertex AI via the US REP endpoint. Location is enforced by the Assured Workloads DATA_BOUNDARY_FOR_FEDRAMP_MODERATE regime; the inherited gcp.resourceLocations organization policy additionally denies global and asia-east2 locations. CMEK encrypted.
us-east4
Virginia · Disaster recovery
AlloyDB cross-region CMEK backups (every 4 hours, 35-day retention) and Cloud Storage file replication. Recovery objectives RTO 12h / RPO 4h.
* All customer data is stored and processed only in the United States, on Google Cloud under Assured Workloads (policy DATA_BOUNDARY_FOR_FEDRAMP_MODERATE, which Google enforces so resources cannot be created outside the FedRAMP Moderate US region set; the policy denies non-US and global locations). Compute and most AI inference run in us-central1 (Iowa); the CUI-classifier batch jobs run on Vertex AI in the US multi-region; durable object storage uses the US multi-region; and disaster-recovery backups replicate to us-east4 (Virginia). All of these are US locations inside the same FedRAMP Moderate Assured Workloads enclave, so data never leaves the US authorization boundary. Every copy is encrypted with customer-managed keys (CMEK) that VirtualDojo controls.
Subprocessors
third parties in the data path| Subprocessor | Purpose | Data handled | Location |
|---|---|---|---|
| Google Cloud Platform | Application hosting, storage, database, AI/ML (Vertex AI) | In-boundary CUI (contract data, PII, documents) | US us-central1 (Assured Workloads) |
| Microsoft | Identity (Entra ID), endpoint management (Intune), productivity (M365) | Administrator identities and device posture | US M365 GCC / Azure |
| SendGrid (Twilio) | Transactional email delivery | System notifications only no CUI | US |
| Stripe | Subscription payment processing | Billing metadata only (plan, tenant ID) no CUI/PII | US |
| GitHub | Source code management and CI/CD | Source code no customer data | US |
Documentation
Public documents; detailed procedures available to agencies| Document | Summary | Version | Words | Updated | Access |
|---|---|---|---|---|---|
| Secure Configuration Guide | How to securely configure and operate the service | 1.2 | 5,528 | 2026-09-08 | View → |
| Data Retention Schedule | Retention periods by data type | 1.0 | 2,498 | 2026-08-27 | Agencies |
| Contingency & Disaster Recovery Procedures | Backup, recovery, and contingency testing | 1.0 | 11,490 | 2026-08-27 | Agencies |
| Operational Security Procedures | Detection, response, and operational controls | 1.2 | 13,355 | 2026-09-08 | Agencies |
| Personnel Security Procedures | Screening, onboarding, and access management | 1.1 | 10,615 | 2026-08-29 | Agencies |
| Supply Chain Risk Management Plan | Third-party and supply-chain risk controls | 1.0 | 11,780 | 2026-08-27 | Agencies |
| Incident Response Procedures | Incident detection, response, and reporting (dissemination controls preclude portal delivery; supplied directly to agencies) | 1.1 | 10,205 | 2026-08-31 | Agencies |
| Privacy Impact Assessment | Privacy analysis of data handling (dissemination controls preclude portal delivery; supplied directly to agencies) | 1.0 | 7,378 | 2026-08-31 | Agencies |
| Risk & Vulnerability Management Procedures | Vulnerability detection, evaluation, and remediation SLAs (dissemination controls preclude portal delivery) | 1.0 | 15,656 | 2026-08-31 | Agencies |
| Continuous Monitoring SOP | Ongoing security-monitoring program (CUI marking review in progress; supplied directly to agencies meanwhile) | 1.0 | 9,513 | 2026-09-01 | Agencies |
| FedRAMP Certification Package (CPO · SDR · OCR) | Full authorization package (human-readable + machine-readable JSON at /reports) | n/a | n/a | n/a | Agencies |
Frequently asked questions
security due diligenceWhere is my data stored?
All customer data is stored and processed within the United States in Google Cloud under Assured Workloads (DATA_BOUNDARY_FOR_FEDRAMP_MODERATE). The primary region is us-central1 and disaster-recovery backups are replicated to us-east4; both are inside the same FedRAMP Moderate Assured Workloads enclave, so data never leaves the US boundary. All copies are encrypted with customer-managed keys (CMEK).
How is data encrypted?
Data is encrypted at rest with customer-managed encryption keys (CMEK) in Google Cloud KMS, and in transit with TLS 1.2+. Cryptography uses FIPS 140-validated modules.
What compliance frameworks do you follow?
VirtualDojo is pursuing FedRAMP 20x Certification (Class C) and a SOC 2 (Security) examination. The service is built on Google Cloud and Microsoft services that hold FedRAMP authorizations. Current status is shown on this page.
Is VirtualDojo FedRAMP High or Moderate?
VirtualDojo AI CRM is assessed to the FedRAMP Moderate baseline via FedRAMP 20x Certification Class C, which matches the Controlled Unclassified Information the service handles. It runs inside Google Cloud's Assured Workloads FedRAMP Moderate boundary and inherits Google's Moderate infrastructure authorization. The application's own certification is in progress.
Who are your subprocessors?
Google Cloud, Microsoft, SendGrid, Stripe, and GitHub. Each subprocessor, its purpose, the data it handles, and its location are listed in the Subprocessors section above.
How do you control access?
Access requires multi-factor authentication and Conditional Access via Microsoft Entra ID, enforces role-based access control and least privilege, and is continuously monitored by the automated KSI validator.
How do you handle security incidents?
VirtualDojo maintains documented incident-response procedures with continuous monitoring and defined notification timelines. Suspected incidents can be reported to security@virtualdojo.com.
How is availability monitored?
Service availability is measured by a Google Cloud uptime check on app.virtualdojo.com, and 46 Key Security Indicators are validated nightly in-boundary. A rolling availability percentage publishes on this page as monitoring history accrues.
What data does the service handle?
The service handles Controlled Unclassified Information (CUI) including government contract data, customer PII, proposal documents, and pricing data, at the FedRAMP Moderate impact level.
How can a federal agency access the full certification package?
The Certification Package (Certification Package Overview, Security Decision Record, and Ongoing Certification Reports) is available through authenticated self-service access at trust.virtualdojo.com/request-access federal (.gov/.mil) requesters are granted access automatically; other requests are reviewed under NDA. After signing in, human-readable report pages and the machine-readable JSON are both available under /reports.
Continuous progress toward certification
Updated quarterlyMarketplace listing, Initial Implementation Phase
Public trust center live; offering listed as in-progress
Automated KSI validation in production
All 46 Key Security Indicators are validated nightly in-boundary. 46 currently meet the Class C two-method corroboration floor; the remaining 0 are in active remediation with tracked closure tasks.
Independent assessment (3PAO)
Independent assessment conducted on 2026-10-02 by Anthony Timbers LLC (FedRAMP Marketplace assessor id 203181). Assessor examination report dated 2026-10-05. The assessor's per-indicator results have not yet been transcribed into this document's assessment arrays.
FedRAMP Certification application
Certification Package (CPO, SDR, OCR) submitted to FedRAMP
FedRAMP review and Certification decision
FedRAMP evaluates the Certification Package and, if accepted, grants FedRAMP Certified status
Ongoing Certification and continuous monitoring
Quarterly Ongoing Certification Reports and nightly KSI monitoring; periodic reassessment to renew the certification
Leveraged authorizations
underlying FedRAMP-authorized providers| Provider & service | FedRAMP ID | Impact | Type |
|---|---|---|---|
| Google Cloud Platform · GCP Assured Workloads, including Vertex AI in-boundary (us-central1 for interactive inference; us multi-region via US REP endpoint for CUI-classifier batch jobs; org policy denies global) | FR1805580474 | Moderate | JAB P-ATO |
| Microsoft · Microsoft 365 GCC | MSO365MT | Moderate | Agency ATO |
| Microsoft · Azure Commercial Cloud (EMS for GCC) | F1209051525 | High | JAB P-ATO |
Access to certification data
For agencies, FedRAMP & customersPublic information above is open to everyone. The full FedRAMP Certification Package (Certification Package Overview, Security Decision Record, Ongoing Certification Reports) and the validation run reports are available through authenticated, self-service access.
Federal agency and FedRAMP personnel with a .gov or .mil email are provisioned automatically. Customers and prospective customers are reviewed by the security team (a non-disclosure or customer agreement must be on file). Every document is available as a human-readable page and as machine-readable JSON; all access is logged.
Log in Request access →