One hardened environment, built in your own cloud account.

For government contractors handling CUI. Controlled information scattered across email, laptops and shared drives is two problems at once: more places an attacker can reach it, and more systems dragged into your assessment boundary.

The enclave puts it in one environment we build, harden and operate for you — which shrinks both at the same time.

The tenant is yours, not ours. No shared infrastructure, no lock-in.

Book a scoping session Which one do I need?
What the environment includes
Microsoft GCC High or Google Assured Workloads
Virtual desktops for everyone in scope
Identity, access and MFA
Protection and patching inside the boundary
Encrypted backup and recovery
Continuous monitoring of the boundary
Built, operated and watched by us. You own every bit of it.

Scattered data is what makes all of this expensive.

Nobody decided to spread controlled information across fifteen laptops and a shared drive — it happened one attachment at a time. But every place that data landed is now something you have to defend, document and answer for.

Everything is in scope When controlled data can be anywhere, your whole company falls inside the assessment boundary — every system, every user, every device held to the same standard.
Everything is exposed A phished account or a lost laptop reaches whatever that person could reach. With data spread wide, that's most of it — and the blast radius is the whole business.
You pay for all of it, forever Every system in scope needs controls implemented, evidenced and maintained. Scope isn't a one-time cost — it's the multiplier on everything you'll ever spend here.
Containment is the highest-leverage move available to you. Put the regulated data in one hardened place and most of your business stops being something you have to defend or prove. Nothing else you can do changes the arithmetic this much.

Built for one job: containing CUI.

The Secure Enclave exists for government contractors handling Controlled Unclassified Information. That is the whole scope of it. Pick what you hold and we will tell you straight whether you need one.

WHAT ARE YOU TRYING TO CONTAIN?

Over-buying a government cloud you don't need is a real and expensive mistake

GCC High costs meaningfully more than commercial and is harder to work in. It exists for CUI and export-controlled data. If your driver is SOC 2, HIPAA or a customer's security requirements, you don't need this product — you need the compliance program run properly in the environment you already have, and we'd rather point you there than sell you a boundary.

How GCC High actually gets delivered — and what it means for your assessment

We deploy and manage Microsoft 365 GCC High as an AOS-G partner through Pax8, in a tenant you own outright. Because we operate that environment on your behalf, we act as an External Service Provider and appear in your boundary description. That's normal and manageable, and we'll walk you through exactly what it means before you sign anything.

A working environment, not a locked box.

Your people still have to do their jobs in here. The enclave is a full workspace — email, files, desktops, collaboration — with the controls built into how it was assembled rather than bolted on afterward.

Everyone works through a virtual desktopLAPTOPS STAY OUT OF SCOPE

CUI never lands on the laptop. Your people connect into the boundary, do the work there, and close the session — which means personal machines, unmanaged devices and the rest of your company's hardware stay outside the assessment entirely. That is the single biggest reason containment is cheaper than the alternative.

INSIDE THE BOUNDARY
The virtual desktops themselves
Enclave identity and access
Email, files and collaboration holding CUI
Backups of all of it
OUTSIDE IT
The laptop or desktop people connect from
Your general company network
Everything the rest of the business runs on
Every system CUI never touches
Identity, access and MFAConditional access, least-privilege roles and multi-factor enforced across the environment — the controls that stop a stolen password becoming an incident.
Protection and patching insideDetection and patch management across the enclave desktops and servers, kept current by us. Unpatched systems are still the most common way in — and inside the boundary they are ours to keep current.
Encrypted backup and recoveryEncrypted, tested backups with a defined recovery path. Ransomware is a backup problem before it's anything else — and untested backups aren't backups.
Continuous monitoringLogging and detection across the boundary, tuned so alerts mean something. Included as part of operating an accredited environment — not sold as a standalone security service.
Collaboration that worksEmail, files, SharePoint and Teams inside the boundary. If people can't do the work in here, they'll do it somewhere else — and that's how data escapes.
Your tenant, no shared infrastructureThe account is yours from day one and your data never sits beside another client's. If you leave, the environment and everything in it stays with you.

Anyone can sell you a tenant. The program is what makes it defensible.

A GCC High tenant on its own is an invoice, not a compliance position. What an assessor actually examines is whether the boundary is described, the controls are implemented, and the evidence is current — continuously, not the week before they arrive.

The Compliance App is required with the enclave, and billed separately The enclave is the environment; the app is the compliance program that runs inside it. Assessors expect the boundary to be described and evidenced continuously, so the two go together — quoted as one program, itemized as two lines. We prepare you for assessment. We're not a C3PAO and we don't grade our own work.
What the program coversEVERY ENGAGEMENT
Control implementation mapped to NIST SP 800-171
A System Security Plan written for your environment
A full policy suite, reviewed and kept current
A POA&M with owners, dates and status
Evidence collected as a by-product of operating
SPRS scoring and annual affirmation support
Your senior official still signs the affirmation. That can't be outsourced — what we do is make sure the evidence behind it holds.

What it costs

Published, like everything else we sell that has a fixed scope. Enclave seats are for users who handle CUI — nobody else needs one.

PER CUI USER$205–$295per user, per month — bands down by seat count
SETUP$4,500one time, flat for every size
SEAT PRICING BY VOLUME
1 – 10 seats$295 / user / mo
11 – 25 seats$265 / user / mo
26 – 50 seats$235 / user / mo
51+ seats$205 / user / mo

The Compliance App is required with the enclave and billed separately. Only users who actually handle CUI need enclave seats — everyone else stays outside the boundary, which is the whole point.

You own the tenant. Licensing is passed through at cost, or bring your own.

See full pricing

Useful on its own. Better with the rest.

The enclave is a delivery vehicle, not a prerequisite for anything else we do. But when it's there, everything else gets cheaper and easier — because there's less ground to cover.

Less to prove

Scope is the multiplier on compliance cost. Contain the data and most of your business falls outside the boundary you have to control and evidence.

Compliance App
All 110 requirements

Where the enclave sits inside the wider obligation — CMMC, NIST 800-171, the SSP, the POA&M and the SPRS score that follows from all of it.

CMMC & NIST 800-171
Somewhere to run AI

An accredited environment is what makes in-boundary AI possible at all — assistants working on your data without it ever leaving your control.

AI GRC

Start here

Find out whether you need one.

Start with a scoping session. We’ll work out what data you actually hold, which platform fits it, and what containment would save you — including telling you if an enclave is more than you need. No obligation.

Book a scoping session Find your gaps

Veteran-founded · Cyber AB RPA-led · Government contractors only