How Mesa for Public Records saved the San Francisco Assessor-Recorder 128,000 staff hours.Read the case studyHow Mesa for Public Records saved the San Francisco Assessor-Recorder 128,000 staff hours.Read the case studyHow Mesa for Public Records saved the San Francisco Assessor-Recorder 128,000 staff hours.Read the case studyHow Mesa for Public Records saved the San Francisco Assessor-Recorder 128,000 staff hours.Read the case study
Security

FedRAMP

Mesa and FedRAMP.

Caldera is pursuing FedRAMP 20x Class A certification for Mesa. This page lists the public information FedRAMP asks providers to publish about their cloud service offering. The same information is available as JSON.

Last updated September 30, 2026

Request security documentation

Cloud service offering.

Offering
Mesa
Provider
Caldera AI Inc., doing business as Caldera PBC
Description
Mesa is an AI platform for government agencies, used by federal, state, and local government staff. It has two workspaces: Research, for researching statutes, regulations, case law, and an agency’s own documents with cited answers, and Public Records, for handling public records requests from intake through review, redaction, and release. Mesa is a multi-tenant software-as-a-service application hosted on Google Cloud in the United States.
FedRAMP ID
Not yet assigned
UEI
S1MQJW75T2X6
Certification target
FedRAMP 20x, program path, Class A
Service model
Software as a service (SaaS)
Deployment model
Public Cloud
Business categories
Artificial Intelligence (AI), Legal & Policy, Research
Website
www.calderapbc.com/platform
Sales contact
Caldera sales, contact@calderapbc.com
Security contact
Caldera security team, security@calderapbc.com

Services.

Each service included in the offering and its security category.

Research

Security category: Low

Research across statutes, codes, and regulations, case law, and documents an agency uploads, with answers that cite their sources. Includes drafting memos and reports from research results.

Public Records

Security category: Low

Handling of public records requests: intake and scoping, collecting and reviewing responsive records, redaction of documents, email, audio, and video, and preparing the release with its response letter and withholding log.

Both workspaces run on a shared platform (document library, user and permission management, single sign-on, and the organization audit log), which is included with them. The uses described under Solutions on this site all run within these two workspaces. Caldera offers no other cloud services.

Progress toward FedRAMP certification.

Our milestones toward FedRAMP 20x Class A certification. We update this list at least once a quarter.

  1. Completed

    September 29, 2026

    SOC 2 Type II report issued

    Unqualified opinion with no exceptions, covering April 28 to July 28, 2026.

  2. Completed

    September 30, 2026

    FedRAMP Marketplace listing request submitted

  3. Planned

    Planned

    FedRAMP 20x Class A gap assessment

  4. Planned

    Planned

    FedRAMP 20x Class A certification package submitted

Last updated September 30, 2026

Documentation.

Trust center
Caldera’s trust center, hosted by Vanta. It holds our SOC 2 Type II report, security policies, subprocessor list, and the current status of our security controls.Request access at trust.calderapbc.com to view the SOC 2 Type II report and other restricted documents. trust.calderapbc.com
Machine-readable
The information on this page in the FedRAMP Certification Package Overview JSON format, generated from the same source: /security/fedramp.json