Delivery model, security and compliance
What we deliver onshore, what can run offshore, and how we protect agency data. Written for IT security reviewers and procurement.
Last updated October 18, 2026
How we deliver public-sector IT work
Agency data stays in the US. Projects run in US-hosted cloud environments, and our offshore engineers work only on code and synthetic test data. They never access production systems or agency records. Where a contract or state law requires all work in the US, we tell you up front and staff it that way, or we pass.
What can go offshore and what cannot
We check every project against this list and your contract before work starts.
| Work | Offshore | Condition |
|---|---|---|
| Front-end builds, website themes, design systems | Yes | Public content, built in your repos or ours |
| Accessibility remediation of public websites | Yes | Public pages |
| Application development in non-production | Yes | Synthetic or masked test data only |
| QA, test automation, regression testing | Yes | Test environments with synthetic data |
| Documentation, training material, user guides | Yes | No sensitive data in source material |
| Production support or admin access to agency systems | No | Many state terms restrict access from outside the US |
| Anything touching criminal justice information | No | CJIS personnel screening, onshore only |
| Anything touching federal tax information | No | IRS Publication 1075 offshore restriction |
| Student and health record systems | Mostly no | FERPA direct control, district agreements, state health record laws |
State rules we plan around
A few examples. Your contract and your counsel have the final word.
| State | Rule |
|---|---|
| New Jersey | All services under state contracts, including subcontracts, must be performed in the US (N.J.S.A. 52:34-13.2). |
| Ohio | Standard terms bar offshore services and remote access to state data from outside the US. |
| Oklahoma | Contract terms state no offshore services, and state data may not be accessed internationally without permission. |
| Georgia | GTA standard SS-15-002 requires state data to stay onshore and bars access from outside the US without an exception. |
| Maryland | Bidders must disclose plans to perform services outside the US. |
| Texas | DIR contracts can require state agency data to stay in the contiguous US when an agency asks. |
This is a summary for planning, not legal advice. Federal rules such as IRS Publication 1075 and the FBI CJIS Security Policy also apply to some agency data. Read our full guide.
Controls we use
Simple controls, applied on every project.
US-hosted environments
Project environments in US cloud regions, or in your own accounts.
Least-privilege access
Named accounts, multi-factor sign-in and access logs. No shared logins.
Synthetic test data
Non-production work uses synthetic or masked data, never live records.
NDAs for everyone
Every team member signs an NDA before joining a project.
1 named project lead
A single contact who works US Eastern business hours.
Clean offboarding
Access removed the day someone leaves the project, with a checklist.
What we do not claim
We would rather tell you what we lack than let you find out later.
- No SOC 2, ISO 27001 or StateRAMP certification today
- No MBE, DBE, HUB or similar certification
- No cooperative contract awards of our own
- No public agency client references on this site yet
Accessibility of this site
We build this site to meet WCAG 2.1 AA, because we ask the same of our own work for agencies. If anything here is hard to use, email info@konnexsolutions.com and we will fix it.
Common questions
For IT security and procurement reviewers. Still unsure? Ask us directly.
Do offshore engineers access agency data?
No. Agency data stays in US-hosted environments. Offshore engineers work only on code and synthetic test data and never access production systems or agency records.
What if our contract requires all work in the US?
We tell you up front. We staff that work in the US, or we pass. Examples include New Jersey state contracts and Ohio's offshore services prohibition.
Do you hold SOC 2, ISO 27001 or StateRAMP?
No. We do not hold those today. This page describes the controls we do use.
Can you meet CJIS requirements?
We do not take on work involving criminal justice information. It requires fingerprint-based screening of everyone with access, which our offshore team cannot meet.
Can you sign our data agreement?
Yes. Send it with your request and we will review it before work starts.
Have a project in mind?
Send the scope, the timeline and your budget range. We reply with questions, a delivery plan and the purchasing route that fits.