A server you host. A desktop app your team installs. A secure update channel between them. Everything else - the encryption, the controls library, the assessor-ready output - is taken care of for you.
Lives in your tenant, on hardware you control. Your SSP, evidence, and audit log never leave your boundary. Strong encryption is on by default.
One signed Windows installer. Each user enters your server URL on first run. The app is purpose-built for compliance work - no extensions, no leaks, no surprises.
We push new control mappings, security recommendations, and feature updates through a verified channel. Your server validates every update before applying it. You stay current without lifting a finger.
We use RSA-4096 - the strong cryptographic standard - to sign and verify every update, every license, and every release artifact. If a single byte gets tampered with anywhere along the chain, your server refuses it. No fall-backs, no exceptions.
The CMMC2Go server runs in your environment. No third-party cloud holds your SSP, evidence, or POA&M. SPA classification, never a CUI repository.
Updates and licenses are cryptographically signed by us and verified by your server. Tampered or unauthorized payloads are rejected automatically.
The desktop app talks to your server. Nothing else. No usage analytics, no error reporting to a SaaS, no phone-home behavior of any kind.
Three things you can fetch from us; nothing of yours.
The Windows desktop installer at /download. The same installer for every customer; only the server URL each user types differs.
A small JSON document that tells installed apps when a new version is available. Cryptographically signed. Your app verifies it before pulling anything.
Your SSP, your POA&M, your evidence files, your auth tokens, your audit log - none of these ever leave your tenant. They live exclusively on the CMMC2Go server in your environment.
Don't worry - your evidence is yours forever. Just the automated tooling takes a break until you're back.
Everything you've already built - SSP, POA&M, evidence bundles - stays right where it is, readable and exportable. You can still hand a current packet to your assessor any day of the week.
The fancy stuff hits snooze until you renew:
Renew whenever you're ready and everything wakes back up instantly - your team picks up exactly where they left off. Nothing to reconfigure, nothing to migrate.
