AI the public sector can actually deploy, inside the cloud you already trust.
Fellowship AI designs, builds, and operates custom AI and automation that runs inside your own authorized cloud environment, under your keys and your controls. The data never leaves the boundary you already trust. Compliance is built into the architecture, not bolted on, and we are precise about what we hold versus what we inherit.
The public sector's hardest constraint: the data cannot leave
Government and regulated work starts from one rule. Sensitive data stays inside an authorized boundary. That is how we build by default. For new systems, the AI runtime, the encryption keys, and the data all sit inside your cloud account, not ours. Single-tenant, isolated, your region. We wire into the systems you already run, with no rip-and-replace, put a human approval gate in front of anything consequential, and log every action for audit.
Your cloud, your keys
For new builds the runtime, encryption keys, and data live inside your own AWS, Azure, or GCP tenancy under your identity controls. No duplication to vendor infrastructure.
Human approval gate
Nothing irreversible happens without a person approving it. Approvals are enforced by the system, not by policy alone, with fail-closed controls on every agent.
Audit log on everything
Every automated action is traceable and reversible. Access is least-privilege, scoped to the engagement, and logged for your reviewers and your ATO package.
Compliance, stated honestly
We are an engineering and services firm, not a cloud service or a software product. FedRAMP authorizations and DoD Impact Levels are certifications for cloud services. They do not attach to a services firm, and we do not claim them. They attach to the environment that hosts the work. We build inside the environment your agency already operates and runs under its own Authority to Operate.
- FEDRAMP HIGH / DOD IL4-IL5 · INHERITED
- When the work runs in AWS GovCloud (US), the Claude models we deploy through Amazon Bedrock are approved for FedRAMP High and DoD Impact Level 4/5 workloads. Your authorized boundary carries the compliance posture. We engineer to its controls. The authorization attaches to the environment and the models, never to us.
- NIST SP 800-171 & NIST CSF · ALIGNED BY DESIGN
- We design and operate to the control families of NIST SP 800-171 and the NIST Cybersecurity Framework: access control, encryption, audit and accountability, configuration management, incident response. We align to these controls as our engineering baseline. We are not independently certified against them, and we say so.
- CMMC · SCOPED OUT OF CUI
- We are not CMMC-certified, and the program's assessment phase is currently suspended. Our posture is to scope engagements so Controlled Unclassified Information is not stored or processed on our infrastructure. Where CUI is in play, the work runs inside your authorized boundary.
- FISMA / ATO · WE BUILD TO SUPPORT YOURS
- We architect and document our work to support your system's FISMA obligations and Authority to Operate: least-privilege access, encryption in transit (TLS 1.2+) and at rest (AES-256), audit logging, and human-in-the-loop controls, so our components fit cleanly inside your authorization boundary.
- SECTION 508 / ACCESSIBILITY
- Accessibility (Section 508, WCAG 2.1 AA) is a build requirement on our engagements when it is specified in a statement of work. We provide a VPAT / Accessibility Conformance Report for delivered software on request. See our accessibility statement.
- FAR / DFARS READINESS
- We are prepared to accept and perform to standard federal contract clauses, including data-handling and safeguarding requirements such as DFARS 252.204-7012 for covered defense information, scoped to each engagement.
- ON REQUEST
- Data Processing Agreement, sub-processor list, and completion of your vendor security questionnaire, directly.
What we hold vs. what we inherit
- ANTHROPIC · INHERITED
- SOC 2 Type II · ISO 27001 & ISO 42001 (AI management) · HIPAA-eligible under a BAA · no training on API customer data
- AWS · INHERITED
- SOC 1/2/3 · ISO 27001 · PCI DSS · HIPAA-eligible · GDPR-compliant data processing · GovCloud (US) FedRAMP High
- FELLOWSHIP AI · HELD
- No certifications held directly, stated plainly. Our own controls: least-privilege access, encryption at every layer, isolated environments, scrubbed logs.
- ON REQUEST
- DPA (same-day, usually) · sub-processor list · your vendor security questionnaire, completed directly
Our capabilities for government
Agentic workflow automation
Multi-step processes executed by supervised AI agents, with fail-closed controls and human approval gates in front of consequential actions.
Document & data extraction
Structured capture from unstructured documents, drawings, and records. Classification, validation, and routing at volume.
Systems integration
Event-driven pipelines across disconnected systems of record, replacing brittle point-to-point integration and manual hand-offs.
Compliance-aware delivery
Data residency, least-privilege access, encryption in transit and at rest, and audit logging as build requirements on every engagement.
Company data & contracting identifiers
- SOCIOECONOMIC STATUS
- Small Business (self-certified). Fellowship AI does not hold and is not pursuing a set-aside socioeconomic certification.
- NAICS
- 541511 Custom Computer Programming · 541512 Computer Systems Design · 541519 Other Computer Related Services · 541611 Management Consulting · 518210 Computing Infrastructure / Data Processing & Hosting
- PSC
- DA01 (IT, Artificial Intelligence) · D302 (IT Systems Development) · D307 (IT Strategy & Architecture) · D308 (IT Programming) · D310 (IT Cybersecurity & Data Backup)
- SAM.GOV
- Registration pending. We will publish the UEI and CAGE the moment they issue. We do not display a placeholder number.
- LEGAL ENTITY
- Fellowship AI LLC · Texas limited liability company
- LOCATION
- Houston, Texas · US-owned
How to work with us
Fellowship AI is a small business (self-certified) and bids as one. We do not hold or pursue a set-aside certification. We are built to support the public sector in three ways today.
Respond to RFIs & sources-sought
Substantive, specific input on your requirement. No registration required to help you shape it.
Team with primes
As a specialist subcontractor on data, AI, and integration scope. We bring the engineering; you carry the vehicle and past performance.
State & local, directly
Direct engagements where federal registration is not required, delivered to the same compliance bar.
Our SAM.gov registration (UEI/CAGE) is pending, to support federal prime and SBIR eligibility. We work under NAICS 541511 / 541512 / 541519 / 541611 / 518210 and PSC DA01 / D302 / D307 / D308 / D310.
Past performance, honestly
As a newer firm, our government past performance is being built. The commercial engagements below are directly relevant in scope, scale, and environment: compliance-gated AI running inside the client's own cloud, with audit logging and human oversight. We never imply a government client.
Compliance-gated AI ops platform
A professional-services firm. Automated timesheet, billing, and document workflows across multiple back-office systems, running in the client's own cloud with role-based access and audit logging.
Document & data extraction pipeline
A services business. Converted unstructured source documents into validated, system-ready data and cut manual processing time substantially.
Collections / operations analytics
A financial-services client. Per-source data integration (ETL) consolidating fragmented sources into a single real-time operating picture.
Frequently asked
- IS FELLOWSHIP AI FEDRAMP AUTHORIZED?
- No, and we will not imply it. Fellowship AI is an engineering and services firm, not a cloud service or product, so FedRAMP and DoD Impact Level authorizations do not attach to us. They attach to the hosting environment. We build inside the environment your agency already operates. When that is AWS GovCloud (US), the Claude models we use via Amazon Bedrock are approved for FedRAMP High and DoD IL4/IL5, and your authorized boundary carries the compliance posture.
- DO YOU HOLD SOC 2 / ISO / HIPAA CERTIFICATIONS?
- Not directly. Our compliance baseline is inherited through Anthropic (SOC 2 Type II, ISO 27001/42001, HIPAA-eligible via BAA) and AWS (SOC 1/2/3, ISO 27001, PCI DSS, HIPAA-eligible). We state it as inherited because it is.
- ARE YOU CMMC CERTIFIED?
- No. The CMMC assessment program is currently suspended, and we are not certified. We scope engagements so Controlled Unclassified Information is not stored or processed on our own infrastructure. Where CUI is involved, the work runs inside your authorized boundary.
- CAN YOU MEET SECTION 508 ACCESSIBILITY REQUIREMENTS?
- Yes. We treat Section 508 / WCAG 2.1 AA as a build requirement when it is specified in a statement of work, and we can provide a VPAT / Accessibility Conformance Report for delivered software on request.
Public-sector point of contact
- CONTACT
- Rayan Riyaz · Founder
- GOVERNMENT INQUIRIES
- [email protected]
- PHONE
- Direct line available on request.
- LOCATION
- Houston, Texas · US-owned
- WEB
- fellowshipaiconsulting.com
- ACCESSIBILITY
- Section 508 / WCAG 2.1 AA is a build commitment on our engagements; VPAT / ACR on request. Accessibility statement →
Bring us your requirement.
We would rather answer your specific question than send you marketing. Email the public-sector team and we will respond directly.