FedRAMP — FreeAI Compliance

FedRAMP Control Alignment

Key Controls Addressed

FreeAI's architecture maps to core FedRAMP security controls through its self-hosted design.

SA-2 — Definition of Security Requirements

Defined by Design

FreeAI ships with a default security policy: LAN-only bindings, UFW firewall, mandatory env vars for secrets, and no hardcoded credentials. Security requirements are explicit and version-controlled.

SA-22 — Unsupported System Components

Dependency Management

Dependency scanner (Safety, Trivy) runs on every build. Pinning in requirements.txt ensures reproducible installs. Auto-patch agent updates vulnerable packages.

SI-2 — Flaw Remediation

Automated Patching

Auto-patch agent generates and applies safe fixes for critical and high vulnerabilities. Verified with test suites before application. Full audit trail of all patches.

SI-4 — System Monitoring

Continuous Monitoring

Health monitor with 10s supervisor loop, 30s health agent, 15s recovery agent. GPU telemetry, service alerts, and anomaly detection run continuously.

CA-7 — Continuous Monitoring

Ongoing Security Posture

Aikido integration provides continuous SAST/DAST scanning. Alert system notifies on security events. Resource optimizer adjusts to maintain performance and cost targets.

PM — Policy & Procedures

Documented Operations

Full documentation of deployment procedures, configuration management, and operational workflows. JSONL audit logs serve as evidence for compliance reviews.

Self-Hosting Advantage for FedRAMP

No third-party cloud processor — you are both data controller and data processor
No shared infrastructure — physical isolation by definition
Full data residency control — all data stays on your network
No vendor dependencies for security controls — everything is configurable
Exportable audit logs satisfy continuous monitoring requirements
CI/CD pipeline with security gates matches FedRAMP authorization packages

FedRAMP — Cloud Compliance