Clear answers for deploying and operating ZeroTrusted.ai.

ZeroTrusted.ai is customer-hosted software built to FedRAMP High security requirements, with STIG-hardened Kubernetes deployment configurations. Customers can deploy on-premises or in their own private or hybrid cloud. ZeroTrusted.ai does not claim a FedRAMP authorization for the product. For a customer-operated SaaS deployment, we provide configuration and SSP information to support inventory updates, authorization-boundary documentation, security impact analysis, control responsibilities, and related assessment artifacts. Authorization remains specific to the customer's system and assessment.

No. The control plane is designed for on-premises, private cloud, hybrid, air-gapped, and restricted deployments. It connects to AWS EKS, Azure AKS, Google GKE, Red Hat OpenShift, RHEL, and other Kubernetes environments while preserving the customer boundary and data residency model.

The platform is model agnostic. The documented provider chain includes organization-managed or direct OpenAI, Anthropic Claude, Ollama local models, and NVIDIA NIM for specialized inference. Provider, model, token, data-egress, and tenant permissions remain explicit in the AI Provider Control Plane.

Agent registration records identity, owner, tenant, skills, autonomy level, model assignment, tools, permissions, guardrails, and version history. Agent Preflight Ops checks those dependencies before a mission. Deep AI System Testing can run benchmarks, human review, mission trace, adversarial testing, certification, remediation, retest, and signed evidence export.

The runtime should report the actual state: connected and receiving data, configured but unverified, unreachable, unauthorized, missing binary, or not applicable. Fail-closed actions do not convert a missing dependency into a successful scan or synthetic finding. The operator receives a troubleshooting path and can queue or reschedule work.

The platform provides mappings and evidence workflows for FedRAMP High-aligned deployments, NIST SP 800-53 Rev. 5, NIST SP 800-171, NIST AI RMF, CMMC 2.0, ISO 27001, ISO/IEC 42001, SOC 2 Type II, HIPAA/HITECH, PCI DSS, NERC CIP, FERC, FERPA, EU AI Act, Japan AI governance, Brazil LGPD, DoD 8140/DCWF, and DISA STIG. A framework mapping supports an assessment; it does not by itself grant an authorization or certification.

MSSP operators can manage many customers while keeping profile, customer, facility, asset, connector, evidence, finding, report, and agent scope explicit. Server-side identity and policy determine ownership. Customer users see only the data and capabilities granted to their profile, and high-impact operations require the configured approval policy.

The platform distinguishes shipped definitions, active tenant registrations, clones, imported agents, development candidates, and runtime-ready handlers. Counts change as new agents and tools are added and as deployments enable or quarantine dependencies. The live tenant inventory and readiness manifest remain the source of truth for a specific installation.

Yes, within the limits of the selected model, tool workload, storage, network, and available compute. A small deployment can run local models and a focused set of agents. Enterprise deployments can add GPU capacity, workers, edge collectors, and queue-aware Autonomous SOC operations without changing the evidence and governance model.