San Francisco saved 128,000 staff hours
Security

FedRAMP

Mesa and FedRAMP.

Mesa is listed on the FedRAMP Marketplace in the Initial Implementation phase, and Caldera is pursuing FedRAMP 20x Class A certification for it. This page lists the public information FedRAMP asks providers to publish about their cloud service offering. The same information is available as JSON.

Last updated October 5, 2026

Request security documentation

Cloud service offering.

Offering
Mesa
Provider
Caldera AI Inc., doing business as Caldera PBC
Description
Mesa is an AI platform for government agencies, used by federal, state, and local government staff. It has two workspaces: Research, for researching statutes, regulations, case law, and an agency’s own documents with cited answers, and Public Records, for handling public records requests from intake through review, redaction, and release. Mesa is a multi-tenant software-as-a-service application hosted on Google Cloud in the United States.
FedRAMP ID
FR2700137035 (Marketplace listing)
UEI
S1MQJW75T2X6
Certification target
FedRAMP 20x, program path, Class A
Service model
Software as a service (SaaS)
Deployment model
Public Cloud
Business categories
Artificial Intelligence (AI), Legal & Policy, Research
Website
www.calderapbc.com/platform
Sales contact
Caldera sales, contact@calderapbc.com
Security contact
Caldera security team, security@calderapbc.com

Services.

Each service included in the offering and its security category.

Research

Security category: Low

Research across statutes, codes, and regulations, case law, and documents an agency uploads, with answers that cite their sources. Includes drafting memos and reports from research results.

Public Records

Security category: Low

Handling of public records requests: intake and scoping, collecting and reviewing responsive records, redaction of documents, email, audio, and video, and preparing the release with its response letter and withholding log.

Both workspaces run on a shared platform (document library, user and permission management, single sign-on, and the organization audit log), which is included with them. The uses described under Solutions on this site all run within these two workspaces. Caldera offers no other cloud services.

Progress toward FedRAMP certification.

Our milestones toward FedRAMP 20x Class A certification. We update this list at least once a quarter.

  1. Completed

    September 29, 2026

    SOC 2 Type II report issued

    Unqualified opinion with no exceptions, covering April 28 to July 28, 2026.

  2. Completed

    September 30, 2026

    FedRAMP Marketplace listing request submitted

  3. Completed

    October 2, 2026

    Listed on the FedRAMP Marketplace

    Package approved for Initial Implementation, under FedRAMP ID FR2700137035.

  4. Planned

    Planned

    FedRAMP 20x Class A gap assessment

  5. Planned

    Planned

    FedRAMP 20x Class A certification package submitted

Last updated October 5, 2026

Documentation.

Trust center
Caldera’s trust center, hosted by Vanta. It holds our SOC 2 Type II report, security policies, subprocessor list, and the current status of our security controls.Request access at trust.calderapbc.com to view the SOC 2 Type II report and other restricted documents. trust.calderapbc.com
Machine-readable
The information on this page in the FedRAMP Certification Package Overview JSON format, generated from the same source: /security/fedramp.json