Custom software for federal agencies, built by an SDVOSB that has shipped through ATO.

Yes. VooStack is certified as a Service-Disabled Veteran-Owned Small Business through the SBA's Veteran Small Business Certification (VetCert) program. That makes us eligible for SDVOSB set-asides, sole-source awards up to $9M for non-manufacturing services under FAR 19.14, and counts toward your agency's 5% SDVOSB goal. We can provide our certification letter, SAM.gov registration, UEI, and CAGE code for your file the same day you ask.

We build the software and produce the artifacts the AO needs to issue an ATO — SSP, POA&M, contingency plan, incident response plan, and the body of evidence for each control. We don't sign the ATO; only the agency's Authorizing Official does that. But we've shipped systems where the ATO landed on schedule because the package was assembled continuously during the build, not bolted on after.

Honest answer: 6 to 14 months from kickoff for a Moderate-impact system, depending on agency cadence and whether you're inheriting an existing CSP authorization. The build itself is rarely the bottleneck — the slow steps are control implementation evidence, independent assessment by a 3PAO if FedRAMP, and the AO's review queue. Anyone quoting you 90 days end-to-end is selling something.

Both. We prime SDVOSB set-asides directly when the ceiling and scope fit. On larger vehicles — SeaPort-NxG, OASIS+, CIO-SP3, Alliant 2 — we sub to primes who need SDVOSB participation to hit small business goals. We've found primes value subs who deliver clean CDRLs and don't create contract-modification drama, and we operate that way.

508 is treated as a functional requirement, not a checkbox. We run axe-core in CI on every PR against WCAG 2.1 AA, do manual screen reader passes (JAWS, NVDA, VoiceOver) on critical workflows each sprint, and produce an ACR using the latest VPAT 2.5 template at delivery. Retrofitting 508 at the end of a project typically costs 15-25% of the original build — designing it in from sprint one is materially cheaper.

AWS GovCloud (US) and Azure Government are the defaults for CUI and FedRAMP Moderate workloads. For systems handling only public or low-impact data, commercial AWS or Azure with FedRAMP Tailored can work and saves significant cost. For DoD IL4/IL5 we use AWS GovCloud or Azure Government with the appropriate boundary. We'll recommend the lowest-friction environment that satisfies your data classification — not the most expensive one.

Yes, with caveats most vendors gloss over. Commercial OpenAI and Anthropic APIs aren't FedRAMP authorized as of this writing — for CUI workloads you need Azure OpenAI in Azure Government, AWS Bedrock in GovCloud, or a self-hosted model on accredited infrastructure. We've built RAG pipelines on Bedrock with Titan and Claude in GovCloud, with full prompt/response audit logging to satisfy records management and FOIA requirements.

Government work is built on transitions — PMs rotate, contracts recompete, primes change. We design for that day from the start: infrastructure as code (Terraform or CloudFormation), runbooks in the repo, ADRs for every non-obvious decision, and a 30/60/90 transition plan. The deliverable isn't just running software; it's a system the next team can operate without a six-month learning curve.

Members of our team hold active Secret and TS/SCI clearances. We can staff cleared engineers onto programs that require them, and we maintain a facility security clearance pathway through sponsorship when a contract requires it. For unclassified-but-sensitive work (CUI, ITAR-adjacent), we use US persons only and document personnel screening to NIST 800-53 PS-controls.