Frequently Asked Questions

Why should we take a chance on a new vendor?

Federal risk tolerance for new vendors is low — we understand that. Here's why CanaStack is a defensible choice:

• 15 years of DoD classified systems experience. Carlos has been operating in federal environments since 2011. CanaStack is a new company, not a new career.
• 12-month warranty is the guarantee. If code breaks post-delivery, we fix it. That's a contractual commitment, not a sales line.
• Fixed pricing means budget certainty. No surprise cost overruns, no hidden consulting fees billed at the back end.
• Compliance-first architecture. NIST 800-171 is integrated from Sprint 1. Not retrofitted. Not a checklist at go-live.

What happens if Carlos is sick or unavailable?

Carlos personally manages each engagement. This isn't a single-point-of-failure risk because all work is version-controlled, fully documented, and maintained in government-accessible formats throughout delivery — not assembled at the end. Carlos is available by phone and email for the full duration of the warranty period. Continuity terms are included in every contract.

What's your track record?

CanaStack was founded in 2026. Pilot work includes internal infrastructure development including an operations dashboard with GitLab API integration and NIST 800-171-aligned audit logging. We are actively pursuing first federal contract awards. References are available upon request — contact Carlos to discuss.

How is pricing structured?

All engagements are fixed-price with milestone-based invoicing. The total cost is agreed before work begins. You pay as milestones are delivered, not as hours are logged. Warranty, compliance testing, and documentation are included in the quoted price — no separate line items. Pricing is scoped per engagement;contact Carlos to discuss your project.

Do you accept government purchase orders?

Yes. All contracts can be structured to align with federal payment terms and FAR compliance requirements. Contact Carlos with your PO language and we'll confirm alignment before engagement.

What if we need to change scope mid-project?

Scope changes are formalized as contract modifications with updated pricing and schedule. We don't absorb unbudgeted work, and we don't bill for scope that wasn't agreed. Clear scope definition upfront is how we prevent surprises on both sides.

Can you work with our CMMC requirements?

CanaStack advises on CMMC readiness — gap analysis, SSP development, SPRS submission support — but we are not a CMMC Assessor Organization (C3PAO) and do not perform official certification assessments. We prepare your organization for assessment. We do not currently hold CMMC Level 2 certification.

What about Secret clearance or classified environments?

We currently operate without a facility clearance (FCL). Carlos holds a prior DoD clearance history from 15 years of classified systems work, but CanaStack as a company does not hold an active facility clearance at this time. For classified work, contact Carlos to discuss the specific requirements and we'll determine fit.

How do you handle data security for AI integration work?

All AI inference runs on on-premise NVIDIA GPU infrastructure. Data never routes through external cloud AI APIs without explicit client approval. For federal clients, data residency is a design requirement from day one — not an afterthought.

How do we know the code you deliver is production-ready?

Every project includes unit, integration, and system testing. A security audit aligned to NIST 800-171 is included in the delivery — not a separate engagement. Acceptance sign-off against documented criteria is required before delivery is considered complete. The 12-month warranty is the standing commitment that production-ready means what it says.

What does "compliance-first" actually mean?

Security controls and NIST 800-171 requirements are part of the architecture before a line of code is written. Access controls, audit logging, and encryption requirements are defined in the design phase. By the time code ships, compliance artifacts are a byproduct of the development process — not a separate audit preparation effort.