Capability Statement

Core competencies

• Specialized software engineering

  Native desktop and systems software (Tauri, Svelte, Rust), CLI tooling, and production architecture for environments that require a written trust boundary.

• Edge AI and small-language-model deployment

  On-device and perimeter-bound inference. Privacy-first AI architectures that keep regulated inputs off vendor APIs and multi-tenant clouds.

• Air-gapped cryptographic systems

  Local-first secrets management with no cloud backend, no telemetry, and no network sockets in the cryptographic core. Commercial product: ARCA Secrets Manager.

• Zero-trust health-tech architecture

  HIPAA-ready system design for PHI that must remain in a named custody boundary — local inference, BAAs when PHI is in scope, and no default cloud vault.

Differentiators & technology assets

• Air-gap by construction

  ARCA's cryptographic core is built without networking crates. CI enforces the constraint. Remote telemetry and multi-tenant vault breaches are not part of the threat surface.

• Local-first data custody

  Customer secrets, model inputs, and vault files remain on customer-controlled media. We do not operate a SaaS vault, identity provider, or telemetry plane for the product.

• No third-party server dependency in the product path

  The commercial binary does not require our servers to unlock, search, or inject secrets. There is no vendor outage, license-server kill switch, or cloud subpoena path into the vault.

• Senior architecture leadership

  Twenty-plus years of senior software architecture across systems, security-sensitive workflows, and production delivery — applied to R&D engineering, not to a staff-augmentation bench.

Federal compliance & data rights

• FAR / DFARS readiness

  We contract under FAR/DFARS terms negotiated in the award. Commercial software is licensed as commercial computer software consistent with FAR 12.212 and DFARS 227.7202.

• SBIR data rights (20-year protection)

  SBIR/STTR technical data and computer software developed under award are offered with the 20-year protection period established for the SBIR program (FAR 52.227-20; DFARS 252.227-7018, as applicable).

• Commercial computer software

  ARCA Secrets Manager is a commercial product. U.S. Government end users acquire only the commercial rights in the standard EULA, not additional government-purpose rights, except as a specific award may provide.

• Phase I / II and subcontract readiness

  Registered in SAM.gov. Prepared to perform NSF, DoD, and HHS Phase I/II R&D and to serve as a small-business subcontractor on software, AI, and cryptographic work.

Past performance / project scope

Federal award history is provided in proposals. Public project scope that contracting officers can evaluate today:

• ARCA Secrets Manager (commercial)

  Buy-once, offline-first, air-gapped cryptographic vault for macOS (Tauri / Svelte / Rust). Argon2id key derivation, XChaCha20-Poly1305 AEAD, native SSH agent, in-memory env injection. No cloud, no telemetry. Product page: /artifacts/arca.

• Advanced services

  Privacy-first AI architectures, edge machine learning and small-language-model deployment, zero-trust health-tech (HIPAA-ready) system design, and federal R&D engineering under written SOW.

We do not list contract numbers, agency awards, or past-performance scores on this site. Those are supplied in the proposal package for the specific solicitation.

SBA size and ownership representations are self-certified in SAM.gov as of this posting. This page does not claim 8(a), HUBZone, WOSB, SDVOSB, or other SBA-certified programs.