Trust Center
How we protect government data, build secure and accessible software, and use AI responsibly, in one place.
Status
SBA-certified Service-Disabled Veteran-Owned Small Business (SDVOSB)
- Legal entity
- Clear Century Inc.
- NAICS
- 541511 · 541512 · 541519 · 518210 · 513210
At a glance
Six commitments behind everything we deliver.
-
Secure by design
Controls aligned with NIST SP 800-53 Rev. 5, and the secure development practices of NIST SP 800-218 in every pipeline.
-
Zero Trust access
Phishing-resistant multi-factor authentication, least-privilege access and encryption in transit and at rest.
-
Software supply chain
A software bill of materials, dependency and container scanning, and peer-reviewed changes for every release.
-
Accessible by default
Section 508 and WCAG 2.1 AA designed in and tested every release, with conformance reports on request.
-
Responsible AI
Every use case governed under the NIST AI Risk Management Framework, with a person accountable for decisions.
-
Privacy first
We collect only what we need, never sell data, and keep government data inside its authorized boundary.
Security
How we protect government systems.
Security is part of the engineering, not a document at the end. These practices apply to every system we build or operate.
- Security planned with your security team from the first sprint, with controls mapped to NIST SP 800-53 Rev. 5.
- Separate development, staging and production environments, defined as code and changed only through peer review.
- Static analysis, dependency, secret and container scanning in every pipeline, with findings fixed before release.
- A software bill of materials delivered with every release.
- Systems we deliver are hosted on cloud services that already hold FedRAMP authorizations at the impact level your data requires, or in your agency’s own authorized environment.
- Centralized logging aligned with OMB M-21-31, with monitored alerting for any system we operate for you.
- Incidents reported within the timelines your contract requires, such as 72 hours for cyber incidents under DFARS 252.204-7012.
- Background investigations and security training your agency requires completed before anyone gets access, and access removed the day it is no longer needed.
Data and privacy
Your data stays yours.
Clear rules for where government data lives and what happens to it.
- Government data stays inside the authorized boundary of the system it belongs to.
- Controlled unclassified information travels only through channels your contract approves, never through this website.
- At the end of a contract, data is returned or destroyed as you direct, with written confirmation.
- This website collects only what you send us plus standard hosting logs, uses no advertising cookies and never sells information.
Responsible AI
Five rules for every AI system we build.
Aligned with the NIST AI Risk Management Framework and current OMB guidance on federal use of AI.
-
People stay accountable
A named person owns every AI-assisted decision that affects the public.
-
Transparent by default
Users know when AI is involved, and every use case is documented for your AI inventory.
-
Measured before release
Accuracy, bias and robustness are tested against representative data, and the results are shared with you.
-
Data boundaries
Agency data stays inside the system’s authorized boundary and is never used to train or fine-tune any model, ours or a vendor’s, unless your contract expressly authorizes it.
-
A clear off switch
Every model can be paused or rolled back without taking the system down.
Accessibility
Section 508, every release.
Interfaces are designed and built to WCAG 2.1 AA, tested with automated checks and assistive technology, and documented in accessibility conformance reports on request.
Vulnerability disclosure
Found a security issue? Tell us.
If you believe you’ve found a vulnerability in this website or in software we deliver, we want to hear about it.
Send a general inquiry with “Security” at the start of your message.
Please
- Give us reasonable time to fix the issue before you share it publicly.
- Avoid privacy violations, data destruction and service disruption while you test.
- Test only systems you are authorized to test. If the system belongs to a federal agency, follow that agency’s vulnerability disclosure policy.
- Include enough detail for us to reproduce the issue.
We’ll confirm we received your report and keep you informed while we fix it.
Documents
Records a buyer can check.
Have a requirement? Let’s talk.
Contracting officers, program managers and prime contractors: send us your SOW, RFQ or sources sought notice, or book a capability briefing.