Software consulting for defense programs, built by people who wore the uniform.

Yes. VooStack is SDVOSB-certified through the SBA's Veteran Small Business Certification (VetCert) program, which replaced the old VA CVE process for non-VA contracts. That matters when your contract has SDVOSB set-aside dollars, subcontracting plan goals under FAR 52.219-9, or when a prime needs to hit small-business utilization on a large IDIQ. We can be your prime on set-asides or your sub on larger vehicles.

Yes. We default to AWS GovCloud or Azure Government for any project touching CUI, with FIPS 140-2 validated endpoints, signed commits, and OIDC-based deployment instead of long-lived credentials. We've built out CMMC Level 2-aligned SDLCs including SSP artifact generation, POA&M tracking, and eMASS uploads. We do not store ITAR-controlled technical data on commercial cloud or commercial GitHub, period.

Several of our engineers hold active Secret or TS/SCI clearances from prior service or contractor work. For programs requiring cleared work, we typically operate as a sub to a prime that holds the facility clearance (FCL), since standing up an FCL takes 6-12 months and requires a sponsoring contract. If your program needs cleared engineers in a SCIF, we'll be direct about what we can and can't staff before you sign anything.

We adapt. Primes have entrenched tooling — Jira with custom workflows, Azure DevOps, ClearCase, ServiceNow change control, Fortify or Coverity for SAST, specific artifact repositories. Fighting that costs you months. We onboard into their environment, follow their branching strategy, deliver artifacts in the formats their IPTs consume, and attend their TRRs and CDRs. Our differentiator is engineering velocity inside their constraints, not replacing their stack.

We can work as a sub on most prime vehicles (SeaPort-NxG, OASIS+, GSA MAS, CIO-SP3/4, Alliant 2) where the prime handles the vehicle and we deliver under their task order. As an SDVOSB we're directly eligible for set-aside awards under FAR 19.14. For direct-to-DoD work we typically engage via SBIR Phase II/III, OTAs through consortia like DIU or Tradewinds, or as a sub on a larger IDIQ.

Honest answer: engineering moves fast, procurement does not. We ship working software in 2-4 week increments internally, but external milestones are gated by CDRLs, ATO timelines, and program office cadence. We've found the trick is decoupling — keep weekly demos with the warfighter or program manager so feedback loops stay tight, while formal deliverables align with PDR/CDR gates. If you need an MVP in 90 days inside an ATO boundary, that's doable with the right scoping.

Yes, with caveats. RAG, LLM-assisted analysis, and ML model integration are increasingly viable on defense programs, but most production LLM use requires either an on-prem model (Llama, Mistral) or a FedRAMP High / IL5 hosted service like Azure OpenAI in Government. We will not pipe CUI to commercial OpenAI or Anthropic endpoints. For unclassified workflows we'll use commercial APIs; for anything CUI or above, the model runs inside the boundary.

Most defense engagements run 6-18 months with a team of 2-6 senior engineers, often as a sub under a prime. T&M rates for cleared senior engineers typically land in the $185-$260/hr range depending on clearance level, location, and contract vehicle overhead. Fixed-price is possible once scope is bounded by a clear SOW and ATO boundary. We'll give you a straight estimate after a scoping call — no six-week proposal theater.

It stays with the government or prime, fully documented. We deliver source, build pipelines, ATO artifacts, threat models, runbooks, and onboarding docs sized for a follow-on contractor who has never seen the system. We do not build dependencies on VooStack-specific infrastructure or licenses. The goal is that another shop could pick up maintenance in 30 days. That's the standard we hold ourselves to on every program.