Hacker News Reader

Would they have shielded instances from rest of instances processing data for plus/pro/enterprise customers?

I expect as much. Having going through FedRAMP before, the alternative would be to make their regular commercial infrastructure be up to FedRAMP standards, which is incredibly onerous (things like change tracking, DR, US Citizen access only to production systems, etc.)

> US Citizen access only to production systems,

What if the employees building the thing are not US citizens?

now now, no one wants to call out the unwillingness to pay fair labor cost of the sausage machine :^)

The thing about FedRAMP is that it's not one thing, it's a framework. Even if you have a FedRAMP package for a system, you need a fresh ATO to use it at any customer.

Technically, there is no citizenship requirement for FedRAMP.

In reality, at every US Government customer I'm aware of, US Persons (Citizen or PermRes) are the only ones that can deploy code to production. You can have non-USP writing code but it must be reviewed and rolled out by USP.

It says that it’s meant to be self hosted

Reply on news.ycombinator.com