Is CETRAI FedRAMP authorized?

No. CETRAI does not hold a FedRAMP authorization and we do not claim one. What we do provide: Cyber Essentials Plus certification, a SOC 2 Type II examination in progress, HECVAT Light completed, annual third-party penetration testing, and US-only data hosting in Azure or AWS US regions. If your solicitation requires FedRAMP, tell us early so you are not evaluating a vendor that cannot meet the mandatory requirement.

Where is resident data hosted and how long is it kept?

Data is hosted in US regions only (Azure or AWS), encrypted with AES-256 at rest and TLS 1.2+ in transit, in a logically isolated single-tenant architecture per client. Retention is configurable at 7, 30, 90, or 365 days, or purged at the end of the session, and a zero-retention mode can be enabled so conversation content is never stored, archived, analyzed, or recoverable.

Can the assistant meet our accessibility requirements?

CETRAI deployments can be configured to support Section 508 / ADA (WCAG 2.1 AA) requirements, and a VPAT / Accessibility Conformance Report is available on request for submission with a bid. Residents can use voice or text interchangeably, which matters for people who cannot navigate a phone tree and for people who cannot use a keyboard.

How do we know it will not invent an answer about our policy?

The assistant answers only from the content your department has indexed and approved, and every answer carries a citation to its source page. Questions outside that content are refused and handed to staff rather than guessed at. Staff can correct an answer in the review console and the correction applies immediately.

Who owns the transcripts and the configuration?

You do. All logs, transcripts, training data, and configurations are the sole property of the client. No client data is used for AI model training and no client data is shared with third parties.

Can several departments use it without sharing data?

Yes. Departments run as logically isolated instances with role-based access control, approval workflows, and full audit logging, so utility billing, permitting, courts, and parks content is answered from separate approved sources and never blended.

CETRAI

AI Assistants for Government and Public Agencies

Resident-facing AI assistants for cities, counties, courts, schools and agencies: answers grounded in your published content, 75+ languages, WCAG 2.1 AA support.

CETRAI gives residents a single place to ask a question and get an accurate answer — by voice or by text, at any hour, in their own language. Every answer is grounded in your agency's own published content and cited back to the page it came from, so nothing is improvised and staff stay in control of what the assistant is allowed to say.

What an AI assistant for a public agency actually does

It answers the routine, high-volume questions that fill a front counter and a main phone line — hours, fees, forms, eligibility, where to go, what to bring, what happens next — using only the content your department has already published and approved. When a question needs judgement, a case record, or a person, the assistant says so and hands the resident to staff. It is a front-door layer over your existing systems, not a replacement for your case management, permitting, or billing platform.

Why public sector is different

Public-sector buyers evaluate differently, and the assistant has to hold up to that evaluation.

You buy through procurement, not a credit card — Evaluators need documentation before a demo matters: security posture, accessibility conformance, hosting location, retention controls, insurance, and a W-9. Those documents exist and are available to evaluators on request, so a bid response is not blocked waiting on the vendor.
Language access is an obligation, not an upsell — Residents arrive speaking whatever language they speak. CETRAI detects and responds in 75+ languages across both voice and text, including switching language mid-conversation, so a language-access commitment is met by the same assistant that answers everyone else.
Accessibility has to be demonstrable — Public-facing services are held to Section 508 and ADA expectations. CETRAI deployments can be configured to support WCAG 2.1 AA requirements, and a VPAT / Accessibility Conformance Report is available on request for submission with a bid.
A wrong answer is a public record — Every response is grounded in approved content with mandatory source citations — no open-web answers and no invented policy. Automated crawls refresh the knowledge base when a published page changes, and staff can correct an answer and see the correction take effect immediately.
Departments do not share a mailbox, and should not share an index — Departments run as logically isolated instances with role-based access, so permitting content, utility billing content, and court self-help content are answered from separate approved sources rather than one blended pile.

Who this is for

Courts is the first dedicated page in this pillar. The remaining sub-audiences are served today by the same platform and configuration approach described on this page — talk to us about the department you are scoping.

Courts & self-help centres — Procedural questions from the court's own self-help pages — filing steps, forms, fees, hours — with explicit no-legal-advice guardrails and handoff to the self-help centre.
Cities & 311 — The non-emergency front door: service requests, utility billing questions, trash and recycling schedules, district lookups, and where-do-I-go routing.
Counties — Multi-department county services answered from each department's own published content, with role-based access per department.
K-12 school districts — Enrolment windows, transfer and boundary questions, transport, calendars, and family-facing forms — in the languages families actually speak.
Higher education — Admissions, financial aid, registrar, and student services questions, with HECVAT Light completed for institutions that require it.
Health & human services — Programme eligibility and document-checklist questions, with HIPAA-ready configuration and an executed Business Associate Agreement where PHI is in scope.
Housing authorities — Waitlist status process questions, recertification requirements, inspection expectations, and reasonable-accommodation request routing.
Permitting & licensing — Which permit applies, what a complete submittal contains, fee schedules, inspection scheduling, and status-check routing into your existing system.
Transit & utilities — Service and outage information, billing and assistance-programme questions, paratransit eligibility steps, and after-hours coverage.
Libraries & parks — Branch and facility hours, card and membership requirements, reservations, programme registration, and seasonal schedules.

Courts & self-help centres

How a deployment works

Five steps from published content to a resident-facing assistant your evaluators can sign off.

1. Ground it in your published content — We index the pages, PDFs, and FAQs your department has already approved and published. That indexed set is the only thing the assistant may answer from, and each answer cites the source page.
2. Scope what it must never do — Refusal behaviour is configured up front: which questions are out of scope, what disclosure the assistant gives about being an AI assistant, and what it must hand to a person instead of attempting.
3. Wire the human handoff — Low-confidence or out-of-scope conversations route to staff — live handoff during business hours, or a captured request with full transcript outside them, including booking a call back into a staff calendar.
4. Give staff a review console — Subject-matter experts monitor conversations, correct answers, and update the knowledge base, with approval workflows, role-based access, and full audit logging of content and configuration changes.
5. Evidence it for your evaluators — Security, accessibility, hosting, and retention documentation is packaged for the bid file, and technical controls are configured and evidenced by CETDIGIT while compliance ownership stays with the agency.

Procurement and compliance

Everything below is the same posture published on the CETRAI trust centre. Nothing here is aspirational: where an assessment is in progress it says so. Certifications & Assessments.

Cyber Essentials Plus certified.
SOC 2 Type II examination in progress.
HECVAT Light completed and available to institutions that require it.
Annual third-party penetration testing, with results available to clients.
Continuous automated vulnerability scanning.

Data Protection

AES-256 encryption at rest; TLS 1.2+ in transit.
US-only data hosting (Azure or AWS, US regions).
Logically isolated single-tenant architecture per client.
Automatic PII detection and masking, configurable per client policy.
Configurable data retention — 7, 30, 90, or 365 days, or purge at end of session.
Zero-retention mode: conversation content can be set never to be stored — not archived, not analyzed, not recoverable.
Clear on close: the visitor-side transcript can optionally be wiped the moment the chat window closes.

Your Data Stays Yours

All logs, transcripts, training data, and configurations are the sole property of the client.
Zero use of client data for AI model training. No client data is shared with third parties.
Notification of any confirmed security incident affecting client data.

Reliable by Design

99.9% uptime SLA with geo-redundant infrastructure.
Disaster recovery: recovery point objective (RPO) of 4 hours and recovery time objective (RTO) of 8 hours.
Graceful degradation: if a model provider is impaired, the routing layer fails over rather than failing the conversation.
Every AI answer is grounded in your approved content with mandatory source citations — no open-web answers, no made-up responses.
Role-based access control, approval workflows, and full audit logging for content and configuration changes.
Access security: SSO via Microsoft Entra ID (Azure AD), Okta, and other SAML/OIDC providers, with multi-factor authentication.

Compliance Support

Deployments are configured to align with GDPR, FERPA, and HIPAA-ready operation with an executed Business Associate Agreement. Compliance ownership remains with the agency; CETDIGIT configures and evidences the technical controls. CETRAI deployments can also be configured to support Section 508 / ADA (WCAG 2.1 AA) requirements — a VPAT / Accessibility Conformance Report is available on request for submission with a bid. Certificates of insurance, W-9, and security documentation are available to evaluators on request.

Frequently asked questions

What public-sector evaluators ask before a bid response is written.

Is CETRAI FedRAMP authorized? No. CETRAI does not hold a FedRAMP authorization and we do not claim one. What we do provide: Cyber Essentials Plus certification, a SOC 2 Type II examination in progress, HECVAT Light completed, annual third-party penetration testing, and US-only data hosting in Azure or AWS US regions. If your solicitation requires FedRAMP, tell us early so you are not evaluating a vendor that cannot meet the mandatory requirement.
Where is resident data hosted and how long is it kept? Data is hosted in US regions only (Azure or AWS), encrypted with AES-256 at rest and TLS 1.2+ in transit, in a logically isolated single-tenant architecture per client. Retention is configurable at 7, 30, 90, or 365 days, or purged at the end of the session, and a zero-retention mode can be enabled so conversation content is never stored, archived, analyzed, or recoverable.
Can the assistant meet our accessibility requirements? CETRAI deployments can be configured to support Section 508 / ADA (WCAG 2.1 AA) requirements, and a VPAT / Accessibility Conformance Report is available on request for submission with a bid. Residents can use voice or text interchangeably, which matters for people who cannot navigate a phone tree and for people who cannot use a keyboard.
How do we know it will not invent an answer about our policy? The assistant answers only from the content your department has indexed and approved, and every answer carries a citation to its source page. Questions outside that content are refused and handed to staff rather than guessed at. Staff can correct an answer in the review console and the correction applies immediately.
Who owns the transcripts and the configuration? You do. All logs, transcripts, training data, and configurations are the sole property of the client. No client data is used for AI model training and no client data is shared with third parties.
Can several departments use it without sharing data? Yes. Departments run as logically isolated instances with role-based access control, approval workflows, and full audit logging, so utility billing, permitting, courts, and parks content is answered from separate approved sources and never blended.

Request procurement documentation

Book a call with the CETDIGIT public-sector team and we will send the security, accessibility, and hosting documentation your evaluation needs — VPAT / Accessibility Conformance Report, HECVAT Light, penetration-test summary, certificate of insurance, and W-9 — alongside a scoped walkthrough for your department.