GovEagle Sub-Processors
Last updated: October 2026
GovEagle uses a small number of third-party companies, called sub-processors, to deliver the GovEagle platform. A sub-processor may process personal data on behalf of GovEagle customers. It does so only on GovEagle’s instructions and under a written agreement.
- Safeguards. Each sub-processor must apply appropriate technical and organizational security measures. Every sub-processor inside our authorization boundary holds a FedRAMP Moderate or High authorization.
- U.S. only. All storage and processing of customer data happens in the United States, including backups and disaster recovery copies. No customer data is transferred outside the U.S.
- U.S. persons. Everyone with access to the production boundary is a vetted U.S. person.
- No model training. AI model providers keep no customer data after processing a request (zero data retention), and nothing is used to train or improve their models.
- Duration. Processing lasts for the term of the customer’s agreement, subject to the retention and destruction terms in that agreement.
- Accuracy. We keep this list current. It names each sub-processor, what it does, and where it processes data.
Not sub-processors. Content sources a customer chooses to connect (Microsoft SharePoint and OneDrive, Google Drive, Box, Dropbox, Egnyte) belong to the customer, who turns each connection on and can revoke it at any time. GovEagle only reads from them. Public federal data sources (SAM.gov and USASpending.gov) receive no customer personal data.
Sub-processors inside the FedRAMP Moderate boundary
GovEagle runs inside the Knox Systems FedRAMP Moderate authorization boundary (FedRAMP Package ID F1206111371).
| Sub-processor | Service(s) | Processing activities | Location(s) of processing | Links |
|---|---|---|---|---|
| Knox Systems, Inc.FedRAMP Moderate CSP | All GovEagle services | Operates the FedRAMP-authorized environment GovEagle runs in, including continuous monitoring, onboarding and operator access. | USA | WebsiteFedRAMP listing |
| Amazon Web Services, Inc.FedRAMP Moderate (JAB) | All GovEagle services | Cloud hosting and storage for the application, database and files. Transactional email through Amazon SES. | USAus-east-1 (N. Virginia), primaryus-east-2 (Ohio), backup replica | FedRAMPPrivacy |
| Google LLC (Google Cloud)FedRAMP High | AI drafting, search and analysis features* | AI model inference through Vertex AI. Hosts GovEagle’s own embedding and reranking models on Cloud Run. Stores configuration in Cloud Storage. | USAus-east1 (South Carolina), Assured Workloads | FedRAMPFedRAMP listing |
| Okta, Inc.FedRAMP Moderate | Sign-in for all users | Authentication, single sign-on and multi-factor authentication for users and administrators. | USAOkta Regulated Cloud | Trust centerFedRAMP listing |
| CrowdStrike, Inc.FedRAMP High | Platform security | Endpoint protection, security event monitoring and vulnerability scanning. Processes security logs that include usernames and IP addresses. | USAFalcon Platform for Government | FedRAMP listing |
| Zscaler, Inc.FedRAMP High | Platform security | Zero-trust remote access for GovEagle and Knox operators. Processes operator connection data, not customer users. | USAZPA Government | FedRAMP listing |
| Wiz, Inc.FedRAMP Moderate | Platform security | Cloud security posture and vulnerability scanning. Processes infrastructure configuration data. | USAWiz for U.S. Government | FedRAMP listing |
* GovEagle uses Anthropic (Claude) and Google (Gemini) models. Both are served by Google Cloud Vertex AI inside the U.S. Assured Workloads environment above. Anthropic does not receive customer data directly. A customer can ask us to turn off Anthropic models for their organization.
Supporting services outside the boundary
These services do not receive Controlled Unclassified Information (CUI) or proposal content. They are disclosed in our System Security Plan.
| Sub-processor | Service(s) | Processing activities | Location(s) of processing | Links |
|---|---|---|---|---|
| Document360Kovai Ltd. | Help center (help.goveagle.com) | Hosts GovEagle’s help articles. Receives a user’s name and email when they open the help center from GovEagle. | USA | Trust center |
Get notified of changes
To be notified when this list changes, email support@goveagle.com with the subject line “Sub-processor updates”.
For more on how we protect customer data, see our security page and privacy policy.