Secure Deployment for Regulated Environments

15+ years trusted on sensitive bids. Choose the deployment that fits your security posture, from a managed US GovCloud service to a Customer-Managed install inside your own facility.

Book a Demo Visit the Trust Center

VisibleThread GovCloud: FedRAMP Moderate Equivalent (3PAO-attested). Independently attested by Ignyte, an accredited 3PAO, and hosted in AWS GovCloud (US).

Deployment Options

Four ways to run VisibleThread. Three are for sensitive and regulated work: US GovCloud, which we operate for you, and Customer-Managed (On-premises and Private Cloud), which you operate yourself.

US GovCloud:VisibleThread-Managed

VisibleThread runs a dedicated service for you in AWS GovCloud (US).

Dedicated single-tenant AWS GovCloud account, hosted in the United States
Operated and accessed only by US persons
AI runs on Amazon Bedrock inside the GovCloud boundary

Basis: FedRAMP Moderate Equivalent (3PAO-attested)

On-PremisesCustomer-Managed

Runs inside your own facility, including air-gapped environments and SCIFs.

Windows Server or Red Hat Enterprise Linux, including bare metal
No external data transmission from the core platform
Your IT team runs the server, database and backups

Basis: inherits the controls of your environment

Private CloudCustomer-Managed

You deploy and manage VisibleThread in your own private cloud, Azure GCC or equivalent.

Azure GCC High or AWS GovCloud environments
Dedicated resources and full administrative control
You provide and manage any LLM

Basis: inherits the controls of your environment

Public Cloud:VisibleThread-Managed

VisibleThread-managed, for teams that are not handling regulated data.

Multi-tenant
Instant access with no setup or maintenance
Continuous updates and high availability

Basis: SOC 2

US GovCloud vs. Customer-Managed

US GovCloud gives you a DoD-recognized basis for placing CUI in a cloud service we operate. Customer-Managed gives you full control over where data lives and who can reach it.

	US GovCloud	Customer-Managed
Security and compliance
Compliance basis	FedRAMP Moderate Equivalent (3PAO-attested), October 2026	Inherits the controls of the environment you deploy into
CUI under DFARS 252.204-7012	Yes, built for CUI workloads	Yes, if your environment meets your CUI requirements
ITAR-controlled technical data	Discuss with our team first	Recommended
AI features	Amazon Bedrock inside AWS GovCloud. No content leaves the boundary, and it is never used to train models.	You provide and manage the LLM (Azure AI, AWS Bedrock or local hosting such as Ollama), and choose which AI features to enable
Encryption	FIPS-validated in transit, AWS KMS at rest	FIPS 140-2 approved encryption, suitable for storing and processing CUI
Operations
Where it runs	Dedicated, single-tenant AWS GovCloud (US) account, hosted in the United States	Your environment: on premises (Windows Server or Red Hat Enterprise Linux), private cloud, or air-gapped facility including SCIFs
Who runs it	VisibleThread	Your IT team
Network connectivity	AWS GovCloud service managed by VisibleThread	Core platform needs no internet connection. Optional add-ons need specific outbound access.
Software updates	Managed by VisibleThread	You apply the installation packages and upgrade releases we provide
Backups, network controls, identity	Part of the managed service	Owned by your IT team
What you provide	Nothing to provision	A server (2 CPU cores, 16 GB RAM minimum, 230 GB disk), a PostgreSQL 16 database, and an LLM plus embedding model if you want AI features
End-user access	Browser, plus Microsoft Word Add-in for writers	Browser, plus Microsoft Word Add-in for writers
Cost and licensing
Where the effort lands	With VisibleThread. Your security team reviews our body of evidence rather than assessing the service from scratch.	With your team, in exchange for full control. Can reduce new approvals if your environment is already authorized.
Licensing	Confirm with your account team	License key provided at onboarding

Optional add-ons in a Customer-Managed deployment

AI features (Visi Chat, document-grounded RAG, Technical Alignment and Proposal Outlines) need an LLM you provide
SharePoint integration needs access to SharePoint Online, GCC or GCC High
Opportunity Search needs outbound access to the VisibleThread opportunity API
You switch on only the add-ons you choose

Upgrading to VisibleThread 7

VisibleThread 7 uses a new, more secure license format
Customers upgrading from earlier versions receive a new license key at onboarding

Your VisibleThread account team can provide pricing and a sizing estimate for either option.

Which One Fits You?

If most of the statements in one column describe your situation, that is likely your starting point. Your account team can confirm the fit.

Choose US GovCloud if you

Handle CUI and need a cloud service that meets the FedRAMP Moderate baseline under DFARS 252.204-7012
Want VisibleThread to run the infrastructure, so your IT team does not have to
Want AI features without sourcing and managing your own LLM
Prefer your security team reviews a third-party attestation rather than assessing the service from scratch
Need a US-only, single-tenant hosted environment for data residency

Choose Customer-Managed if you

Handle ITAR-controlled technical data
Need to run inside an air-gapped facility, a SCIF, or behind your own firewall with no external data transmission
Want to choose and control your own LLM, or run without AI
Already operate an environment that meets your security and export requirements, such as on premises, Azure GCC High or AWS GovCloud
Need to control exactly where data is stored and who can access it

Questions to settle before you decide

Which data categories will go into VisibleThread: CUI, ITAR-controlled technical data, or both?
Does your export-compliance team require air-gapped or fully self-controlled hosting?
Does your IT team have capacity to run the server, database, backups and upgrades?
Do you need AI features, and if so, do you have an approved LLM available?
Does your contract or prime require a specific FedRAMP posture or an agency ATO decision?

On ITAR: your organization remains responsible for its own export compliance program, including deciding which data categories go into any system. VisibleThread software is classified as EAR99 under the US Export Administration Regulations. To discuss GovCloud for export-controlled data, our team can walk your security and export-compliance teams through the access model.

FedRAMP Moderate Equivalency Explained

The DoD standard for cloud services that store, process or transmit Covered Defense Information, including CUI, for contractors under DFARS 252.204-7012.

To be equivalent, a cloud service must

Meet 100% of the current FedRAMP Moderate security control baseline
Be assessed by a FedRAMP-recognized 3PAO
Provide a full body of evidence: System Security Plan, Security Assessment Plan and Report, and Plan of Action and Milestones
Be reassessed annually

What it means for VisibleThread GovCloud

The attestation covers our own cloud service offering: the application, its configuration, our operations and our people
We inherit AWS infrastructure controls such as physical and data center security, under a documented shared-responsibility model
Your data is hosted only in the United States, in a dedicated single-tenant environment
Your security team can review our body of evidence instead of running its own assessment from scratch
Using an equivalent cloud service helps support your CMMC posture

Customer-Managed deployments run in your own environment, so your own accreditation applies.

Equivalency vs. Authorization
	FedRAMP Moderate Equivalency	FedRAMP Authorization
Built for	Defense contractors handling CUI under DFARS 7012	Federal agencies using cloud services directly
Baseline	FedRAMP Moderate, 100% met	FedRAMP Moderate
Assessed by	Accredited 3PAO	Accredited 3PAO
Sign-off	Contractor reviews the body of evidence	Agency or FedRAMP issues an authorization

Common Questions

Are you FedRAMP authorized?

VisibleThread GovCloud is FedRAMP Moderate Equivalent, independently attested by an accredited 3PAO. That is the DoD standard for contractors handling CUI, which is the work our customers do.

Will my agency accept it?

Agencies make their own ATO decisions, and we are glad to share our attestation to support that review.

Do you rely on another vendor’s authorized environment?

No. The VisibleThread GovCloud service is assessed in its own right and runs in a dedicated AWS GovCloud (US) account for each customer.

Is customer data used to train AI models?

No, in either deployment.

Do VisibleThread support staff have access to our data?

No, in either deployment.

Can we change deployment later?

Talk to your account team about your requirements and timeline.

“VisibleThread revolutionizes how you review a contract. What once took hours of copying and highlighting is now prepped in seconds.”

Jennifer Alvarado, Contract Administrator, Parker

Review the Documents Yourself

Subject to an NDA, we can share the following with your security team. To request any of these, or to discuss which option fits, contact your VisibleThread account team.