Salesforce partner for the DIB

Salesforce, built for mission tempo

Built and sustained inside GovCloud and air‑gapped classified orgs. Your org, your licenses, cleared US hands.

See what we deliver

Rocket Lab is an independent Salesforce partner, not Salesforce. Your org, your metadata, your licenses.

Armaments Research CompanyParkerKUOG Inc.SafranVitesseAttollo EngineeringWärtsiläLyntris

Most partners can build it. Fewer can build it inside the boundary.

Three ways we deliver, each with a sample of what lands on your desk.

01 · Implementation

Architected for the boundary first.

We scope inside FedRAMP High from session one. Parity gaps surface in week one, not in UAT.

Implementation scope ›
architecture.decisionsSample
Architecture decision logAcme Aerostructures (fictional)
ADR-07Opportunity and Contract set to Private; access by program roleDecided
ADR-08CUI fields sit behind one permission set, off default layoutsDecided
ADR-09Legacy CRM history loaded with source IDs kept for lineageDecided
ADR-10Planned AppExchange package not usable in the boundary; Flow insteadOpen
Sample on a fictional org. Client deliverables use this format.
02 · ISV & development

Built to pass the security review.

Apex, integrations and data at volume, written to survive AppExchange review.

Development scope ›
security-review.readinessSample
AppExchange security review readinessAcme Aerostructures (fictional)
Code AnalyzerNo high findings; two medium findings triagedClear
CRUD / FLSQueries run in user mode across the packageClear
CalloutsNamed credentials only, no secrets in codeClear
False positivesWrite-up drafted for two scanner findingsOpen
Sample on a fictional org. Client deliverables use this format.
03 · Managed services

A named senior engineer. Not a ticket queue.

One senior DIB resource, month to month. Partner with your admin, or hand us the whole org.

Compare to a full-time hire ›
monthly.reportSample
Monthly report, SeptemberAcme Aerostructures (fictional)
ReleasesThree deployed, each through sandbox with approver sign-off
RequestsFourteen closed, two carried into October
SecurityOne new finding, fixed inside the month
NextField Service pilot and an admin training session
Sample on a fictional org. Client deliverables use this format.
01 / 03

Three assessments. Not interchangeable.

Most Salesforce risk is a permission, not an exploit. We tell you which test you need.

org-review.findingsSample
Modify All Data outside adminHigh
Guest can read CasesHigh
Unused connected appMed
12-hour session timeoutLow

Org Security Review

Read-only review of permissions, guest surface, code and connected apps. Each finding mapped to 800‑171.

pentest.scopeSample
Partner site, guest profileIn scope
Denial of serviceOut
Two weeks, named contactsWindow
Written authorizationSigned

Penetration testing2

A real test, properly authorized. Performed by us or a specialist US firm we select and manage.

readiness.gap-listSample
AC.L2-3.1.1Met
IA.L2-3.5.3Not met
AU.L2-3.3.1POA&M
SC.L2-3.13.11Met

CMMC readiness3

Control by control against NIST SP 800‑171. A scored gap list, a plan of action and evidence.

Build low. Deploy high.

We build and test on the unclassified side, packaged so your cleared team can deploy into air‑gapped orgs.

  1. AppExchange, callouts and DevOps dependencies flagged before anything is built.

  2. Unlocked or second-generation packages with a signed-off manifest.

  3. Step by step, written for the cleared team doing the high-side deployment.

  4. A security baseline and evidence set built for the high-side review.

  5. A Salesforce architect for your bench. Classified access comes through a cleared prime.4

release.r24-07 · high-side handoffSample
01Parity check: 3 dependencies flaggeddone
022GP package built, manifest signeddone
03Deployment runbook, 14 stepsready
04Baseline and evidence set attachedready
05Handoff to cleared deployment teamscheduled
Sample on a fictional program. Client releases use this format.

Nothing reaches production without your approval

A launch sequence, not a discovery phase that never ends.

Sandbox first, every time

Each release goes through a sandbox, a change record and your named approver before it ships.

change.CR-0142Sample
→Validated in UAT sandboxpass
→Change record and rollback planfiled
→Approver: program IT leadwaiting
Deploys only after sign-off.

Your metadata, your repository

Every change lands as metadata you own, with the decision written down beside it.

repo · mainSample
●Restrict Contract sharing to program roleADR-07
●Move CUI fields behind one permission setADR-08
●Replace blocked package with FlowADR-10
Fictional org. Your repo, your history.
01

Mission brief

Thirty minutes on your program, your regime and the real deadline.

02

Architecture

Data, security and integrations documented against 800‑171 first.

03

Build & validate

Two-week increments in a GovCloud sandbox. Tests and docs are done.

04

Sustain

Hypercare, admin enablement, then managed services if you want it.

Cleared, contained, accountable

Six rules that go into the statement of work, not just onto a web page.

You choose the scope

Access is granted against a named statement of work. We do not browse.

Sandbox first

Nothing reaches production without your named approver.

No standing admin credential

Elevated access is time-boxed and removed at close-out.

CUI stays inside the boundary

Never copied to laptops, tickets, screenshots or AI tools.

Your metadata, your repository

Every change lands as metadata you own.

Cleared US hands

The principal holds a DoD Secret clearance and does the work.

Cyber AB Registered Practitioner Advanced badge
Credential of record

Registered Practitioner Advanced

Bound by the Cyber AB Code of Professional Conduct. Not an assessment authority.3

Cyber AB Registered Practitioner Organization badge
Organization of record

Registered Practitioner Organization

Authorizes non-certified CMMC consulting, not assessment.

PDF · 1 page · CAGE 170Z9

Compliance takes time.
Getting started does not.

Pick the shape that fits your contract. Every proposal is firm fixed price.

Engagement models

Rocket Lab Project

Fixed scope

A defined outcome with a date: an implementation, a migration or a rescue.

Includes:
  • Milestone billing
  • Architecture documented
  • Admin enablement
  • Hypercare at go-live

Rocket Lab Managed

Month to month

A dedicated DIB resource for far less than a full-time senior hire. Thirty days notice to cancel.

Compare to a hire
Includes:
  • Named senior resource
  • Monthly roadmap and report
  • Scheduled org security review
  • Cancel any time

Rocket Lab ISV

Long horizon

Engineering capacity for product teams on the platform, through security review and beyond.

See ISV scope
Includes:
  • Apex and package architecture
  • AppExchange review prep
  • Release engineering
  • Long-horizon roadmap
Full scope for every service →

Where we stop

  • Certifying you. That takes a C3PAO, and advising on readiness disqualifies us from assessing.
  • Writing the ATO package or a full SSP as the primary deliverable.
  • Staffing a cleared on-site team at scale. We supply the architect and the low-side build.
  • ERP, network or endpoint builds, or Microsoft-stack migrations.

Where we earn our keep

  • Salesforce has to live in GovCloud or an air-gapped org, and the boundary is fixed.
  • CUI is in scope and the sharing model has to keep it contained.
  • An assessment is coming and the platform side needs real evidence.
  • You want the person who scoped it to still deliver it in month six.

Frequently asked questions

Do you actually work inside Salesforce Government Cloud?

Yes. Delivery happens inside the FedRAMP-authorized GovCloud boundary, with US-based personnel and a cleared principal. If your program needs commercial Salesforce instead, we will say so.

What exactly is your CMMC credential?

Our principal is a Cyber AB Registered Practitioner Advanced and the firm is a Registered Practitioner Organization. Both are for helping you prepare. Neither certifies anyone. Only a C3PAO can.

Who will actually do the work?

The principal who scoped your engagement, backed by a small vetted US bench for surge. No handoff to an offshore team after the sale.

How do you handle CUI and ITAR-controlled data?

Controlled data stays inside the authorized boundary, never on laptops, in tickets or in AI tooling. Realistic testing uses masked data.

Can you support classified or SCIF Salesforce programs?

Yes, from the unclassified side. We build, test and package releases that your cleared staff deploy on the high side. For classified access, we work through a cleared prime.

Do you work as a prime or a subcontractor?

Both. On platform work we are comfortable as prime; on larger programs we are the Salesforce piece under an SI or program prime.

All 18 questions

Pick a time. Right here.

Tell us the program, the tempo and the compliance regime. Live availability from our calendar.

No sales team. You talk to the principal who does the work. No NDA needed for a first call.