{
  "$schema": "https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json",
  "serviceIdentification": {
    "fedRampPackageId": "Juume AI, Inc. (JUUME)",
    "ueiNumber": "SU6BHPRRBMM3",
    "providerName": "Juume AI, Inc.",
    "serviceName": "Juume AI Platform",
    "serviceAcronym": "JUUME",
    "serviceDescription": "The Juume AI Platform is a multi-tenant, AI-powered application platform delivered as Software-as-a-Service and hosted on Google Cloud Platform (us-central1, Iowa). The platform combines large-language-model and retrieval-augmented-generation (RAG) capabilities — including a managed vector database deployed Bring-Your-Own-Cloud (BYOC) inside Juume AI's GCP boundary, and containerised developer and inference environments — to deliver AI-assisted workflows to enterprise and government customers.\n\n**Hosting and shared responsibility:** Production runs entirely on Google Cloud Platform (FedRAMP High, Package ID FR1805751477), US-only region us-central1. Physical security, hypervisor isolation, and underlying hardware controls are fully inherited from GCP's High authorization. Juume AI is responsible for configuration, identity and access management, application security, and the continuous data pipelines that operate within that boundary.\n\n**Data protection:** TLS 1.2+ in transit, encryption at rest, network segmentation into policy-enforced trust zones, continuous posture monitoring via Google Cloud Security Command Center.\n\n**Current independent assurance:** SOC 2 Type II (Security, Availability, Confidentiality, Privacy), examination period 15 January 2026 – 30 August 2026, report issued 23 September 2026, no exceptions noted.\n\n**Entity identifiers:** UEI SU6BHPRRBMM3 · CAGE 23ZJ6.\n\n**FedRAMP status:** Initial Implementation Phase — pursuing FedRAMP 20x Class A Program Certification under the Consolidated Rules for 2026. Not yet FedRAMP Certified.",
    "certificationType": "20x",
    "website": "https://www.juume.ai",
    "logo": "https://data.juume.ai/assets/juume-ai-logo.png"
  },
  "serviceProperties": {
    "serviceType": [
      "SaaS"
    ],
    "deploymentModel": "Public Cloud",
    "businessCategory": [
      "Artificial Intelligence (AI)",
      "Development Tools",
      "Analytics"
    ],
    "trustCenter": {
      "repositoryType": [
        "Trust Center",
        "Assessment Reports",
        "Policies",
        "Ongoing Certification Reports",
        "Incident Reports"
      ],
      "url": "https://www.juume.ai/trust-center",
      "repositoryDescription": "Juume AI's FedRAMP-compatible Trust Center. Public tier: service overview, FedRAMP progress, policy summaries, this JSON document, incident notices, and Ongoing Certification Reports. Restricted tier (NDA / verified agency identity): SOC 2 Type II report and bridge letter, penetration test summary, policy documents, and Security Decision Record.",
      "authenticationRequired": true,
      "accessRequestInstructions": "Public information requires no login. To request restricted FedRAMP Certification Data:\n\n1. Email **security@juume.ai** with subject line `FedRAMP Access Request`.\n2. Include your name, agency or organization, official (.gov/.mil preferred) email address, and the documents you need.\n3. Federal agency personnel are granted access on identity verification; other parties are sent a mutual NDA for signature.\n4. Access is provisioned within **5 business days**. Per FedRAMP rule CDS-UTC-AAD, Juume AI notifies FedRAMP within 5 business days of any denied agency request."
    },
    "secureConfigurationGuidance": {
      "repositoryType": [
        "Secure Configuration Guidance"
      ],
      "url": "https://www.juume.ai/trust-center",
      "repositoryDescription": "Recommended secure configuration of the Juume AI Platform for customer administrators: SSO/MFA enforcement, role-based access, API key rotation, data-retention settings, and audit-log export.",
      "authenticationRequired": false
    },
    "additionalRepositories": [
      {
        "repositoryType": [
          "Availability Reporting"
        ],
        "url": "https://juume.ai/status",
        "repositoryDescription": "Current and 30-day historical availability of core platform services with availability incidents, in human-readable and JSON formats. Hosted separately from the platform so it remains available during a platform outage (CDS-CSO-AVR).",
        "authenticationRequired": false
      },
      {
        "repositoryType": [
          "Incident Reports"
        ],
        "url": "https://juume.ai/status",
        "repositoryDescription": "FedRAMP Initial, Ongoing, and Final Incident Reports for FedRAMP Reportable Incidents (IEC-CSO-FIR). Contains an attestation of no reportable incidents when none have occurred.",
        "authenticationRequired": false
      },
      {
        "repositoryType": [
          "Shared Responsibility Matrix"
        ],
        "url": "https://data.juume.ai/shared-responsibility.json",
        "repositoryDescription": "Customer Responsibility / Shared Responsibility Matrix describing controls inherited from Google Cloud Platform (FR1805751477), controls operated by Juume AI, and controls the customer agency retains. Machine-readable copies: https://data.juume.ai/shared-responsibility.json and .csv.",
        "authenticationRequired": false
      }
    ],
    "nextOngoingCertificationReportDate": "2027-02-01"
  },
  "contactInformation": [
    {
      "contactType": "Security",
      "contactName": "Juume AI Security Team (FedRAMP Security Inbox)",
      "contactEmail": "security@juume.ai",
      "contactPhone": "703-555-0100"
    },
    {
      "contactType": "Sales",
      "contactName": "Juume AI Public Sector Sales",
      "contactEmail": "publicsector@juume.ai",
      "contactPhone": "703-555-0101"
    },
    {
      "contactType": "Primary",
      "contactName": "Tyson Powell, Head of IT & Security / CISO",
      "contactEmail": "compliance@juume.ai"
    }
  ],
  "advisors": [],
  "certifiedServices": [
    {
      "serviceName": "Juume AI Platform (core application)",
      "serviceDescription": "Multi-tenant SaaS application delivering AI-assisted workflows to enterprise and agency users. **Security category:** Low (confidentiality: low, integrity: low, availability: low). Handles customer-submitted content and AI-generated outputs.",
      "dateAvailable": "2026-01-15"
    },
    {
      "serviceName": "Retrieval-Augmented Generation & Vector Search",
      "serviceDescription": "Managed RAG and vector-search capability supporting the platform's AI features, backed by a managed vector database. **Security category:** Low. Handles embeddings derived from customer content.",
      "dateAvailable": "2026-01-15"
    },
    {
      "serviceName": "Containerised Developer & Inference Environments",
      "serviceDescription": "Isolated container workloads used to build, test, and run platform capabilities. **Security category:** Low. Does not directly store customer data at rest.",
      "dateAvailable": "2026-01-15"
    },
    {
      "serviceName": "Platform APIs & Integrations",
      "serviceDescription": "REST APIs through which customers programmatically access platform functionality. Authenticated via customer-issued API keys. **Security category:** Low.",
      "dateAvailable": "2026-01-15"
    }
  ],
  "thirdPartyInformationResources": {
    "certified": [
      {
        "fedRampCertifiedThirdPartyInformationResource": "FR1805751477",
        "useCase": "Google Cloud Platform (FedRAMP High) — all production compute (Kubernetes), managed PostgreSQL, object storage, networking, and Security Command Center monitoring in us-central1. Physical security, hypervisor isolation, and hardware controls are inherited from this authorization."
      },
      {
        "fedRampCertifiedThirdPartyInformationResource": "FR2634450946",
        "useCase": "Pinecone — managed vector database deployed Bring-Your-Own-Cloud (BYOC) inside Juume AI's GCP project; embeddings derived from customer content remain within the Juume AI GCP boundary. Pinecone's control plane is covered by its FedRAMP package."
      }
    ],
    "nonCertified": [
      {
        "name": "GitHub",
        "provider": "GitHub, Inc.",
        "website": "https://github.com",
        "useCase": "Source-code management, peer review, and CI/CD deployment pipeline for the platform. Does not handle customer data."
      },
      {
        "name": "Rippling",
        "provider": "People Center, Inc.",
        "website": "https://www.rippling.com",
        "useCase": "Workforce identity, single sign-on, HRIS, and endpoint device management for Juume AI personnel."
      },
      {
        "name": "SentinelOne",
        "provider": "SentinelOne, Inc.",
        "website": "https://www.sentinelone.com",
        "useCase": "Endpoint detection and response on company-managed devices."
      },
      {
        "name": "Jira",
        "provider": "Atlassian Pty Ltd",
        "website": "https://www.atlassian.com/software/jira",
        "useCase": "Change, vulnerability, and incident tracking."
      }
    ]
  }
}