Three delivery services and three assessments for Salesforce in Government Cloud. Each one shows a sample deliverable on a fictional org.
Build it, ship it, keep it running.
We scope inside FedRAMP High from session one. Parity gaps surface in week one, not in UAT.
| ADR-07 | Opportunity and Contract set to Private; access by program role | Decided |
| ADR-08 | CUI fields sit behind one permission set, off default layouts | Decided |
| ADR-09 | Legacy CRM history loaded with source IDs kept for lineage | Decided |
| ADR-10 | Planned AppExchange package not usable in the boundary; Flow instead | Open |
Apex, integrations and data at volume, written to survive AppExchange review.
| Code Analyzer | No high findings; two medium findings triaged | Clear |
| CRUD / FLS | Queries run in user mode across the package | Clear |
| Callouts | Named credentials only, no secrets in code | Clear |
| False positives | Write-up drafted for two scanner findings | Open |
One senior DIB resource, month to month. Partner with your admin, or hand us the whole ecosystem.
| Releases | Three deployed, each through sandbox with approver sign-off | |
| Requests | Fourteen closed, two carried into October | |
| Security | One new finding, fixed inside the month | |
| Next | Field Service pilot and an admin training session |
Three tests, not interchangeable. We tell you which one you need.
Read-only review of permissions, guest surface, custom code and connected apps. Every finding carries a severity, a fix and the 800‑171 control it maps to.
| High | Three users hold Modify All Data outside the admin profile | 3.1.5 |
| High | Guest user can read Case records on the partner site | 3.1.22 |
| Med | Connected app with full scope, unused for 180 days | 3.1.1 |
| Low | Session timeout set to twelve hours | 3.1.11 |
Scoped and authorized in writing, then performed by us or by a specialist US‑based firm we select and manage. We own the remediation and the re‑test.
| In scope | Partner Experience Cloud site and its guest profile | |
| Out of scope | Denial of service, social engineering, production data changes | |
| Window | Two weeks, business hours, named contacts on both sides | |
| Sign-off | Written authorization from the org owner before testing starts |
Control by control against NIST SP 800‑171, ending in a scored gap list, a plan of action and assessor-ready evidence.
CMMC Level 1 and Level 2 do not require a penetration test; only Level 3 does. Readiness is preparation. Only a C3PAO certifies.
| AC.L2-3.1.1 | Authorized access control | Met |
| IA.L2-3.5.3 | Multifactor authentication | Not met |
| AU.L2-3.3.1 | Audit logs created and retained | POA&M |
| SC.L2-3.13.11 | FIPS-validated cryptography for CUI | Met |
Air‑gapped orgs cannot reach the internet, AppExchange or most DevOps tools. We engineer releases on the unclassified side so your cleared team can carry them across.
Every managed package, callout and internet-dependent feature flagged before build, with an air-gap alternative.
Development and test in an IL5 or unclassified mirror of your org, under our CI/CD runbook.
Unlocked or second-generation packages, a signed-off manifest and versioned source you own.
Deploy, verify and rollback steps written for your cleared staff on the high side.
Org hardening and 800‑171 evidence built in, so the high-side review has nothing to chase.
A small-business subcontractor with a cleared Salesforce architect. Classified access comes through the prime.4
We do not hold a facility clearance today. Teaming inquiries: sales@rocketlab.us
CUI handled correctly, FedRAMP boundaries respected, evidence your auditors accept.
Delivery inside the authorized GovCloud boundary.
Control mapping and evidence trails in-platform, by a Cyber AB Registered Practitioner Advanced.3
CUI safeguarding across data model and sharing.
Cloud and incident-reporting clauses respected.
Access boundaries designed for export control.
No offshore development. DoD Secret clearance held by the principal.
Not just the parts that demo well.
Not a differentiator on a source selection. It is how the firm is set up to operate.
Committing profit, product and employee time: donated Salesforce architecture and engineering hours for mission-driven organizations.
Permanent carbon removal through Stripe Climate, facilitated by Frontier. Removal, not offsets. Where the 1% goes ›
Thirty minutes on your boundary, your timeline and the work. You leave knowing what it takes.
One percent of Rocket Lab revenue is committed to permanent carbon removal, not offsets, and not renewable-energy credits against emissions already released.
Stripe aggregates contributions from member businesses and buys removal through Frontier, its in-house team of science and commercial experts, as an advance market commitment. Pooling demand is the point: no single small firm can move a technology down the cost curve, but 25,000 of them can.
These are two examples from a broader portfolio of early-stage removal technologies, selected by Stripe's scientific reviewers. Rocket Lab chooses the commitment, not the projects.
