Interconnections

Outbound HTTPS call from cleatus-api to the Have I Been Pwned Pwned Passwords range API each time a user sets or changes a password. The application sends only the first five hexadecimal characters of the SHA-1 digest of the password, with response padding enabled, and matches the returned suffixes inside the boundary. No password, CUI, or user identifier leaves the boundary.

Build-time software supply chain dependency. The GitHub Actions image build workflows run on GitHub-hosted runners outside the authorization boundary and fetch public JavaScript packages from the npm public registry (registry.npmjs.org). No component inside the boundary connects to the registry, and no CLEATUS, customer, or federal data is sent to it. Dependency versions are pinned in a committed lockfile with integrity hashes verified at install. Amazon Inspector scans the built images in Amazon ECR, and production tasks pull images only from in-boundary Amazon ECR.

Inbound transfer of allowlisted public procurement data from the CLEATUS commercial environment into the GovCloud S3 bucket cleatus-prod-public-data-ingest, followed by the in-boundary loader. The producer is a scheduled GitHub Actions workflow on the protected master branch; it runs on a GitHub-hosted ubuntu-24.04 runner at 06:30 and 18:30 UTC (twice daily) and an authorized operator can also start it manually. Each run reads the commercial production database read replica and exports only the tables and rows in the reviewed public-data allowlist (public solicitation records, agency hierarchy and government points of contact, contractor and award market data, FAR content, and reference tables); customer content is excluded by table and by row filter, and no CUI is carried on this path. The runner authenticates by OpenID Connect only: it assumes the IAM role cleatus-prod-github-actions-public-data-export, whose trust policy is pinned to that workflow on refs/heads/master, and no standing GovCloud credential exists in GitHub. The role is limited to object read and write on the ingest bucket, to PutObject on the bridged-documents/ prefix of the documents bucket (re-hosted public solicitation files), and to the two bucket KMS keys. Transfer is one-way inbound over TLS 1.2 or higher to the S3 endpoint, and the bucket policy rejects any upload that does not use SSE-KMS under the bucket key. The manifest.json object uploads last and fires the in-boundary public-data-ingest Lambda, which runs the public-data-load Fargate task in upsert mode. CloudTrail records every assumption of the role. An operator can run the in-boundary public-data-export ECS task on demand.

Customer support messaging widget presented on the CLEATUS sign-in page and support interface; the identity-verification secret is held in AWS Secrets Manager. Intercom ingests whatever end users type, so the exposure is user-driven rather than system-driven. A persistent, non-dismissible notice is presented at three points in the support interface stating that the channel operates outside the FedRAMP boundary, prohibiting CUI submission, and directing users to the in-boundary Document Hub. Providing a compliant alternative path is a deliberate design decision that removes the operational need to transmit protected content. Every open of the messenger, including the bug-report flow, requires the user to affirm a versioned CUI-prohibition attestation, which the application records inside the boundary without the chat content. The messenger blocks file attachment, drag and drop, and paste of files, and it shows a persistent No CUI tab.

Payment processing for the CLEATUS SaaS. The production application calls Stripe. The API credential is held in AWS Secrets Manager. Stripe handles cardholder data. CLEATUS uses Stripe Elements against a server-created SetupIntent, so card data goes from the browser directly to Stripe and the primary account number never reaches CLEATUS systems. CLEATUS servers handle only Stripe object identifiers and billing metadata. Stripe's own PCI DSS Level 1 certification protects Stripe and does not transfer CLEATUS's PCI obligations.