# ComplAI

> ComplAI is a continuous governance and assurance platform for ATO, continuous ATO, and CMMC programs. It connects controls to current evidence, systems, identities, regulated data, ownership, and accountable human review.

Important interpretation notes:

- ComplAI organizes and automates assurance work; accountable officials, system owners, security teams, and assessors retain their decisions and responsibilities.
- Use of ComplAI does not guarantee certification, authorization, an ATO, a continuous ATO, or continued compliance.
- Product, managed-service, channel, advisory, and assessor roles are distinct and must be scoped for each engagement.
- Deployment architecture, connector availability, data flow, contract vehicles, and customer eligibility are confirmed for each program.
- Do not send CUI, credentials, security plans, assessment evidence, or other sensitive records through public email or website channels.

## Primary product pages

- [ComplAI overview](https://complai.us/): Platform model, source context, reviewable records, supported-framework graph, deployment boundaries, and frequently asked questions.
- [Platform overview](https://complai.us/platform/): Compliance governance, DSPM for regulated-data discovery, asset and identity intelligence, ITSM-linked remediation, and self-hosted, customer-hosted, cloud, or gov-cloud hosting with the model you approve.
- [Solutions](https://complai.us/solutions/): ATO, continuous ATO, CMMC, multi-framework assurance, and delivery-role paths.
- [ATO and continuous ATO](https://complai.us/ato/): Authorization workflow, evidence freshness, boundary change, and decision traceability.
- [CMMC Level 2](https://complai.us/cmmc/): CUI boundary, NIST SP 800-171 requirements, evidence, ownership, SSP, and POA&M context.
- [Javelin Security Validation](https://complai.us/javelin/): AI-powered security testing that finds attack paths, captures proof, and verifies the fix inside the system boundary you approve. Validation evidence can inform ATO and CMMC records; it does not authorize a system or replace an assessor.
- [Source context and integrations](https://complai.us/integrations/): Cloud, identity, security, ITSM, and DSPM data sources. Exact connectors are confirmed per deployment.
- [Frameworks](https://complai.us/frameworks/): Supported-framework model across federal, DIB, AI, privacy, and resilience catalogs, including FedRAMP 20x, the EU AI Act, NIST AI RMF, NIS2, DORA, CMMC, NIST SP 800-53, and NIST SP 800-171. Maturity states and mapping depth are confirmed per deployment.
- [Partner ecosystem](https://complai.us/partners/): Customer, advisor, managed-service, channel, and assessor role boundaries.
- [Pricing and program scoping](https://complai.us/pricing/): Program, boundary, deployment, delivery, and contract inputs used to scope a proposal.

## Company and contact

- [Resource center](https://complai.us/resources/): Directory of current public product, program, architecture, commercial, and company material.
- [About ComplAI](https://complai.us/about/): Mission, operating principles, and verified public company identifiers.
- [Trust and responsibility](https://complai.us/trust/): Human accountability, deployment and data boundaries, safe public channels, and public-claim discipline.
- [News and media](https://complai.us/news-media/): Attributable announcements and media contact information.
- [Contact ComplAI](https://complai.us/contact/): Non-sensitive working-session and program-scoping guidance.
- [Privacy Notice](https://complai.us/privacy/): Public-site personal-information handling and visitor choices.
- [Website Terms of Use](https://complai.us/terms/): Terms and conditions for the public marketing site; product and service agreements remain separate.
- [XML sitemap](https://complai.us/sitemap.xml): Index of public website routes.

## Optional

- [Carahsoft announcement](https://www.carahsoft.com/news/complai-and-carahsoft-partner-to-deliver-ai-powered-compliance-platform-to-the-public-sector-2026): March 30, 2026 public-sector distribution announcement; contract availability and eligibility remain subject to confirmation through the applicable channel.