This document summarizes how Artorias Sentinel addresses the security, privacy, and operational obligations expected of a Department of War PAI alerting service. It is a pointer to authoritative mapping and the production control posture, not a substitute for the formal Authority-to-Operate (ATO) packet, which is furnished separately to sponsoring contracting officers on request.
1. Scope
This statement describes Sentinel's compliance posture in relation to:
- The Privacy Act of 1974 (5 U.S.C. § 552a) and the Intelligence Community Commercially Available Information (CAI) Policy Framework.
- DoW Directive 3115.18, DoD Access to and Use of Publicly Available Information.
- NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.
- FAR 52.239-1, Privacy or Security Safeguards.
- DFARS 252.204-7009, 252.204-7015, and 252.239-7010.
- Operational and availability obligations specific to the PAI Alerting Service Statement of Objectives (SOO, 20 Apr 2026).
2. Data handled
Sentinel ingests, enriches, and distributes unclassified, publicly available information drawn from open sources: news and official sources, and social and messaging channels. The platform does not accept, store, or process classified or Controlled Unclassified Information (CUI) submitted by operators. Operators are contractually prohibited from uploading such material (see Terms of Service §5).
Operator-identifying data retained by Sentinel is limited to that required to operate the service: identity assertions from the sponsoring command's identity provider, session artifacts, audit records, and per-user configuration (watchlists, mission profiles, geofences, saved reports, and notification settings). This data is held in AWS GovCloud and is not transmitted outside that boundary.
3. Source attribution and external links
Every Sentinel alert carries the originating publisher's name and, where available, a textual reference URL. Per SOO objective 11, Sentinel does not enable direct hyperlinking from within the alert UI to external publishers. References are rendered as textual attribution that an operator may copy and, subject to command guidance, open through a separately sanctioned browser. This design prevents Sentinel from functioning as a gateway into untrusted external content while preserving full source traceability for analysts.
4. Privacy Act & IC CAI Policy Framework
Sentinel is designed to avoid the intentional collection of U.S. person information. Collection activities are confined to the topics, entities, and geographies configured by authorized operators for their assigned missions and are subject to the controls in DoWD 3115.18. Items referencing U.S. persons that are inadvertently surfaced are handled under DoWM 5240.01 minimization procedures, including retention limits and access controls; material is purged within the shortest retention window authorized by policy.
The Platform's logging, auditing, and access-review controls support the IC CAI Policy Framework's requirements for documented purpose, access controls, minimization, retention, and periodic review of commercially sourced information.
5. DoWD 3115.18: access and use of PAI
Every operator completes an annual acknowledgement of the Operator Agreement, which captures the DoWD 3115.18 attestations required for PAI access. The acknowledgement record includes the operator's identity, a timestamp, and the version of the Agreement accepted; access is denied if the acknowledgement is not current.
6. NIST SP 800-171 & FAR 52.239-1
Sentinel implements the family of controls in NIST SP 800-171 to protect CUI-adjacent operational metadata and user information. Key controls:
- Access Control: role-based authorization (platform roles admin, analyst and viewer; organization roles member and admin), with every user required to belong to an active organization; least-privilege access scoping, short-lived session tokens, and session timeouts, with the screen locking after 15 minutes without input.
- Identification & Authentication: SAML SSO integration with sponsoring commands' identity providers; PIV-capable authentication in staged rollout.
- Audit & Accountability: authentication events, authorization decisions, administrative actions, and material user actions are logged with retention sufficient for forensic review.
- Configuration Management: infrastructure-as-code, version-controlled deployment pipelines, signed artifacts, and gated promotions between environments.
- Incident Response: 24/7/365 on-call rotation, documented runbooks, and breach-notification procedures that meet FAR 52.239-1(b) and DFARS 252.204-7012 reporting obligations.
- Media Protection, Physical Protection: inherited from the AWS GovCloud customer-responsibility matrix; Artorias does not operate any non-cloud premises that process Sentinel data.
- System & Communications Protection: TLS 1.2+ in transit, customer-managed KMS keys at rest, network segmentation between ingestion/enrichment/serving tiers, and WAF in front of the public edge.
- System Integrity: dependency-pinning, automated vulnerability scanning on every build, and signed container images.
The full SP 800-171 control mapping is maintained separately and available to sponsoring contracting officers on request.
7. DFARS 252.204-7009, -7015, -7012
- DFARS 252.204-7009: third-party information used in Sentinel's enrichment pipelines is used only for the purposes authorized by the originating agreement; Artorias does not use contractor-furnished or other third-party information for any purpose beyond contract performance.
- DFARS 252.204-7015: Sentinel provides the notice-of-authorized-disclosure mechanism required for litigation-support access, routed through the contracting officer.
- DFARS 252.204-7012: cyber-incident reporting procedures are documented in the Sentinel Cybersecurity Plan; reportable incidents are submitted to the DoD Cyber Crime Center within 72 hours of discovery.
8. DFARS 252.239-7010: cloud computing services
Sentinel is hosted on AWS GovCloud (US), us-gov-west-1, aligned with DoD Impact Level 4 requirements. The hosting arrangement:
- Keeps all Government data inside the United States within AWS GovCloud.
- Supports the inspection, audit, and investigation rights described in DFARS 252.239-7010(c).
- Supports prompt return of Government data upon contract termination.
- Flows down this clause to any subcontractor or service provider that has physical or logical access to the Government data environment.
9. Help-desk coverage (SOO §V.17)
Artorias provides 24 hours a day, 365 days a year help-desk coverage for Sentinel:
- Primary channel: sentinel@artorias.com (monitored continuously).
- Severity-1 (platform down / major functionality unavailable) response target: under 30 minutes, 24/7/365.
- Severity-2/3 response target: next business day.
- Escalation paths to engineering on-call are documented in the Sentinel runbook furnished to sponsoring commands.
10. Training support (SOO §V.19)
Artorias delivers user-facing training in the cadence required by the SOO:
- Up to four (4) remote onboarding User Training sessions scheduled on Government request, with at least one session per month.
- Up to four (4) remote Web Conference User sessions per week, with at least one per month.
- At least two (2) User Training sessions and two (2) Web Conference sessions per week are scheduled to permit attendance by globally-deployed personnel (time zones outside the continental United States).
- Session materials are retained, and the User Guide covers the platform for asynchronous review.
11. Low-bandwidth operation (SOO §V.21)
Sentinel's web and mobile clients support a Low Data Mode designed for degraded communications environments, such as SATCOM. In this mode:
- The operator sets a severity floor, HIGH and CRITICAL or CRITICAL only, and lower-priority alerts are not shown until the mode is turned off.
- The client checks for new reports on a slower interval chosen by the operator (1, 5 or 15 minutes), with fewer requests and smaller pages.
- Push notifications still arrive, and every check asks for the floor and every level above it, so a CRITICAL alert is never dropped.
- On the web, toasts, sound and the CRITICAL banner keep working. On the phone, the mode turns on by hand, after asking on a weak link, or automatically after a sustained weak link.
12. Mobile distribution: DISA approval (SOO §V.22)
Sentinel's iOS and Android clients are distributed through the platforms' pre-release and internal distribution channels for authorized operators during pre-production rollout. Artorias is pursuing approval of the Sentinel mobile client through the DISA Mobile Application Vetting Program (and, where command-specific, the DoW App Catalog) for distribution on Government-furnished mobile devices. The vetting submission covers:
- Static and dynamic application security testing artifacts.
- Privacy policy mapping against the NIAP Protection Profile for Application Software.
- DISA STIG Viewer checklists for iOS and Android variants.
- Third-party library inventory with known-vulnerability scan results.
Status of the vetting submission is available to contracting officers on request.
13. Quarterly reporting (SOO §V.20)
Artorias delivers a quarterly operational report to the sponsoring Government program manager covering, at minimum:
- Active user base and usage statistics (sign-in counts, session duration distribution, session counts per command).
- Service performance (availability, response-time percentiles, degradation incidents and their resolution).
- API integration utilization (push notification volume, number and scope of active integrations).
- Alert delivery statistics (volume by severity, delivery channel mix, median time-to-alert).
- Training events delivered.
- Technical improvements delivered during the reporting period: PAI source additions, pipeline enhancements and model updates.
- Other metrics supporting ROI assessment and program management.
14. Accessibility (Section 508)
Sentinel's web interface is developed against the WCAG 2.1 AA standard that Section 508 incorporates by reference. Accessibility-specific design elements include a high contrast mode, a reduced-motion setting, full keyboard navigation with a published shortcut list, and a feed table that presents the map's reports as a sortable list for screen-reader and AT users. The mobile clients label every control for VoiceOver.
15. Audit, monitoring, and data retention
Authentication events, authorization decisions, administrative actions, and material user actions are logged centrally. Logs are retained for a period sufficient for security and compliance review and are available to the sponsoring command's security officer on request, subject to the access limits in the Terms of Service and Operator Agreement. Operator-furnished configuration (watchlists, profiles, geofences) is retained while the account is active and deleted within 90 days of account deactivation unless a contracting-officer hold is in place.
16. Business continuity
Sentinel's production deployment uses multi-Availability-Zone redundancy within AWS GovCloud us-gov-west-1. Pipeline state and configuration databases are backed up on a continuous basis with point-in-time recovery. The Continuity of Operations (COOP) plan furnished as FA701426R0008 Attachment is the authoritative document and is updated on an annual basis.
17. Subcontractors and flow-downs
Any subcontractor with access to the Sentinel Government data environment is subject to the same security, privacy, and reporting obligations that bind Artorias. Clause flow-downs include NIST SP 800-171, DFARS 252.204-7012, DFARS 252.239-7010, and the DoWD 3115.18 operator-acknowledgement regime for any individual with Platform access.
18. Document lifecycle
This Compliance & Security statement is reviewed annually and whenever a material change occurs in the Platform's security posture. The canonical version is always the one at sentinel.artorias.com/compliance.html. The effective date and version in the header above are normative.
19. Contact
- Compliance / legal: legal@artorias.com
- Security & incident reporting: security@artorias.com
- Operational support: sentinel@artorias.com
This Compliance & Security statement is a public summary. Detailed control mappings, the Authority-to-Operate packet, the COOP plan, and the Cybersecurity Plan are furnished to sponsoring contracting officers on request.