SparkAE is an independent pre-assessment engine. It evaluates an authorization package against NIST SP 800-53A determination statements and returns Satisfied / Other-Than-Satisfied findings with evidence citations, confidence, and defensibility grades.
SparkAE is not a Third Party Assessment Organization (3PAO), and it does not issue the official Security Assessment Report (SAR) or an Authorization to Operate (ATO). Its findings are intended to support readiness and the EXAMINE pass — not to replace the independent assessment a FedRAMP Recognized assessment service performs or the decision an authorizing official makes. You remain responsible for your own compliance determinations.
You agree not to:
SparkAE is deterministic and reproducible, but automated findings can contain false positives and false negatives and depend on the quality and completeness of the package you provide. Findings are provided “as is” for your review and judgment. To the maximum extent permitted by law, SparkAE disclaims implied warranties; nothing here overrides the warranty and liability terms of your written agreement.
The live and standalone demos run against synthetic, fictional data (for example, “CloudVault Federal”). Sample artifacts shown on this site do not describe any real system or organization.
The public reference build — the in-browser engine, the 800-53A catalog, the export builders and the site pages published in the public repository — is licensed under the Apache License, Version 2.0. Nothing on this page limits the rights that license grants for that code. The SparkAE server product — the API, multi-tenant service, audit chain, integrations, assessor console and its exporters — is proprietary and confidential, licensed and not sold, under the SparkAE Proprietary Software License and your written agreement. The SparkAE name and marks are reserved. NIST SP 800-53 and 800-53A text is a work of the United States Government. The IBM Plex and Fraunces typefaces are used under the SIL Open Font License 1.1.
Both are commercial computer software and commercial computer software documentation as those terms are defined at FAR 2.101. Consistent with FAR 12.212 (civilian agencies) and DFARS 227.7202-1 through 227.7202-4 (DoD), the Government acquires each only under the licence customarily provided to the public: for the public reference build, the Apache License 2.0 published with it; for the server product, its written commercial agreement. Use, duplication, disclosure, modification and release are governed by those licences and no others.
Nothing on this page or elsewhere on this site is the licence or modifies it, and where this page and a licence differ, the licence governs. A federal acquisition is made under the written agreement executed for it, not under this page.
The SparkAE server product is proprietary and confidential, licensed and not sold; the public reference build is Apache-2.0 (see Licensing above). All trademarks and product names referenced (Drata, Vanta, Paramify, RegScale, ServiceNow, Archer, Jira, and others) belong to their respective owners and are used only for identification.
We may update these terms; the “last updated” date above reflects the current version. Material changes affecting a commercial relationship are handled through your written agreement.
Questions about these terms? Email info@sparkae.ai.