{
  "schema": "nineline.trust-public/1",
  "kind": "public-information",
  "generatedAt": "2026-10-22T01:58:59+00:00",
  "rule": "CDS-CSO-PUB",
  "fedRampId": "FR2701857797",
  "fedRampIdAssigned": true,
  "provider": "Optimal Labs",
  "service": "9line",
  "description": "9line tells agencies which vulnerabilities in their software and AI supply chain actually affect them, with evidence an assessor can re-check. A customer submits a repository or container image through the web application or API. 9line generates a CycloneDX SBOM, inventories the AI models and agents it contains, matches components against vulnerability data, and determines whether each vulnerable code path is reachable using a deterministic call-graph engine. It returns a VEX document in which every statement carries its evidence. An in-boundary model (Amazon Bedrock in AWS GovCloud) explains verdicts but cannot clear a finding.",
  "certificationType": "20x",
  "certificationClassSought": "C",
  "certificationPath": "Program",
  "serviceModel": [
    "SaaS"
  ],
  "deploymentModel": "Government Community Cloud",
  "businessCategory": [
    "Cybersecurity & Risk Management",
    "Artificial Intelligence (AI)",
    "Development Tools"
  ],
  "ueiNumber": "TYMSGKDF2K48",
  "salesContact": {
    "contactName": "Ryan Gutwein",
    "contactEmail": "support@gooptimal.io"
  },
  "securityContact": {
    "contactName": "Ryan Gutwein, ISSO",
    "contactEmail": "support@gooptimal.io"
  },
  "productWebsite": "https://gooptimal.io/nineline",
  "logo": "https://gooptimal.io/optimal-logo.svg",
  "certificationPackageOverview": "https://gooptimal.io/trust/nineline/cpo.json"
}