Pitbull Audit trust center
FedRAMP information for Pitbull Audit, an audit management platform for government auditors. Pitbull Audit LLC is pursuing a FedRAMP 20x Class C (Moderate) certification.
Using this trust center. Everything on this page is public, and the same information is published as JSON for GRC tools and FedRAMP: fedramp.json (FedRAMP's Certification Package Overview schema). Progress toward certification is on the progress page (progress.json), and the service's current and 30-day availability on the availability page (availability.json), measured every 5 minutes from outside production. The certification package for agencies will be here once the independent assessment is complete; until then, agencies and FedRAMP can ask for early access at security@pitbullaudit.com.
Next milestone: Independent assessor chosen and booked, November 30, 2026.
The service
Pitbull Audit is an audit management platform for government auditors. Workpapers, evidence, supervisory review, findings and reporting sit in one environment, and every finding traces back to the evidence that supports it. It is built for audits under the Government Auditing Standards (the Yellow Book, GAGAS), used by federal Offices of Inspector General, and the IIA Global Internal Audit Standards, used by state and local government auditors.
Agency users sign in through their own agency's identity provider, with its PIV/CAC and multi-factor authentication. AI features, which find evidence that may support a statement, run on Amazon Bedrock inside the same AWS FedRAMP boundary; the auditor decides what is sufficient and appropriate evidence and what gets linked.
The service runs in AWS US East (us-east-1), with backups copied to AWS US West (us-west-2), in an AWS account used for nothing else. Pitbull Audit is pursuing a FedRAMP 20x Class C (Moderate) certification.
Public information
| FedRAMP ID | Pitbull Audit (PBA) (FedRAMP assigns an ID with the Marketplace listing) |
|---|---|
| Provider | Pitbull Audit LLC |
| Service | Pitbull Audit (PBA) |
| Certification | FedRAMP 20x, Class C (Moderate): in progress |
| Service model | SaaS |
| Deployment model | Public Cloud |
| Business category | Governance, Risk, and Compliance (GRC), Collaboration, Artificial Intelligence (AI) |
| UEI number | D59VTQCM4KX7 |
| Sales contact | Pitbull Audit sales: admin@pitbullaudit.com |
| Security contact | Pitbull Audit security: security@pitbullaudit.com |
| Product website | https://pitbullaudit.com/ |
| Product logo | https://trust.pitbullaudit.com/pitbull-audit-logo.png |
| Secure configuration guidance | Published with the certification package (in preparation). |
| Trust center | https://trust.pitbullaudit.com/ Pitbull Audit's FedRAMP trust center: this public information, the progress toward certification, and, once the offering is assessed, the certification package for agencies. Sign-in required: no Type: Trust Center |
| Repository | https://trust.pitbullaudit.com/package/ The FedRAMP certification package for agencies, in human-readable and JSON forms with an API: the policies and procedures now, and the overview, minimum assessment scope, security decision record, secure configuration guide, and assessment and ongoing certification reports as each is approved. Sign-in required: yes Sign in at https://trust.pitbullaudit.com/package/ with a federal (.gov or .mil) email address: a one-time code is emailed to you and access is immediate, with no request to approve. Agency systems use API tokens that a signed-in person makes there. Anyone else may ask at security@pitbullaudit.com. Type: Certification Package, Assessment Reports |
| Next Ongoing Certification Report | None yet: these begin once certified. |
| Independent assessor | Being chosen from the FedRAMP Recognized assessors. |
Services in the certification
Every feature of Pitbull Audit is in the FedRAMP Minimum Assessment Scope. All of them hold federal customer data at the Moderate security category.
| Service | What it does |
|---|---|
| Workpapers and evidence | The audit file: workpapers, evidence files and engagement records, with retention and disposition. Security category: Moderate. |
| Workpaper & review workflow | Preparation, supervisory review, comments and approvals in one structured environment built around the audit file. Security category: Moderate. |
| AI-assisted cross-indexing | Searches the whole engagement for evidence that may support a statement and points to the source, using Anthropic Claude models on Amazon Bedrock (US regions only). The auditor decides what is linked. Security category: Moderate. |
| Findings and reporting | Findings and report language, each traced to its supporting evidence. Security category: Moderate. |
| Audit trail | Review history, comments and changes preserved throughout the engagement. Security category: Moderate. |
| Time & expense tracking | Hours per team member, total time per audit, and audit expenses, kept with the work itself. Security category: Moderate. |
| Agency single sign-on | Sign-in through the agency's own identity provider (SAML 2.0), including PIV/CAC and the agency's multi-factor authentication. Security category: Moderate. |
Not included
- The marketing website (pitbullaudit.com) and this trust center
- Pitbull's test environments (test.pitbullaudit.com, test-beta.pitbullaudit.com), which hold no agency data
- Each agency's own identity provider, which the agency runs
Third-party services
| FedRAMP certified | Use |
|---|---|
| AGENCYAMAZONEW | Amazon Web Services (US East/West): Hosts the whole offering: compute, database, storage, keys, network, identity, logging and security services, in a dedicated production account |
| AGENCYAMAZONEW | Amazon Bedrock (Anthropic Claude models, US inference profiles): AI features: text an agency user chooses to send for analysis is processed by the model and the result returned |
No third party outside a FedRAMP certified offering handles federal customer data.
Documentation
What Pitbull Audit supplies for the offering, in human-readable and JSON forms:
| Document | Contents | Status |
|---|---|---|
| Certification Package Overview | What the offering is, who is accountable for it, and how to reach them. | in preparation |
| Minimum Assessment Scope | Every resource, information flow and third party in the boundary, with security categories. | in preparation |
| Security Decision Record | How each FedRAMP rule and Key Security Indicator is met, with measurements from the daily automated record. | in preparation |
| Secure Configuration Guide | The agency's top-level administrator account and the security settings only it can change. | in preparation |
| Policies and procedures | Incident response, vulnerability detection and response, change management, secure development, training, third parties, data removal, logged events and the quarterly security review. | approved; shared with the package |
| Monthly vulnerability reports | Every vulnerability tracked in the month, with FedRAMP's required fields, and detection and response activity. | produced monthly from November 2026; shared with the package |
| Ongoing Certification Reports | Quarterly, once certified. | after certification |
Programmatic access
The public data is JSON over HTTPS, readable from any web application: responses carry Content-Type: application/json, X-Content-Type-Options: nosniff and Access-Control-Allow-Origin: *.
GET https://trust.pitbullaudit.com/fedramp.json: the Certification Package Overview (FRC-CSO-PKG)GET https://trust.pitbullaudit.com/progress.json: goals and dated milestonesGET https://trust.pitbullaudit.com/availability.json: current status, 30-day availability of each core service, and incidents (updated every 5 minutes)
Updated November 13, 2026.