Building AutoSAM: required to verify; no government lookup
Andrew Caperton, Senior .NET Engineer
This is a public writeup of AutoSAM. It is not a product launch post, and it is not a second engineering case study. I am the founder of GovCertix LLC and the builder of AutoSAM. I started the company and the codebase in December 2025. Code work became primary in February 2026. I built it in under a year, solo.
The engineering case study already lives on this site. If you want the build receipts, read that. This piece is the account of why the problem exists, what AutoSAM actually is, what I chose to build first, and where the work stands in August 2026.
The paradox
Defense primes are required to verify each subcontractor's CMMC status under DFARS 252.204-7021 and 252.204-7012, and to screen exclusions under FAR 9.405. The Department of Defense does not publish subcontractor CMMC status or SPRS scores to primes. The DoD CIO FAQ (C-A4) is plain about this: there is no government lookup.
That is the whole problem. The obligation is real. The lookup does not exist. AutoSAM exists to keep proof that the check was done.
The product notes a $45,000 covered-subcontract threshold under FAR 9.405, that 23% of federal contractors lapse SAM.gov registration each year, and that roughly 98 authorized C3PAOs leave assessment queues running into 2027. None of that creates a government API for a named sub's CMMC status. The work still has to be done, and it has to be defensible.
What AutoSAM is
AutoSAM is a multi-tenant, zero-custody supply-chain compliance platform: the diligence-of-record for defense primes and for the consultant firms and RPOs that manage subcontractor networks. Connect contracts and subs. It derives flow-down obligations from the real award portfolio, screens the network against public government data, flags gaps that put contracts at risk, and keeps the audit-defensible evidence that diligence was done, continuously.
GovCertix LLC is a Virginia LLC based in Alexandria. It is the legal parent. The brand architecture is AutoSAM, by GovCertix. GovCertix is not a product, not a C3PAO, and not a consulting firm.
AutoSAM is not a C3PAO, not an assessment, and not a compliance guarantee. It is not affiliated with SAM.gov or the U.S. Government. It does not verify, certify, or guarantee a subcontractor's cyber posture. CMMC and SPRS are captured as sub-attestations with provenance. That distinction is load-bearing. I am not going to blur it for a cleaner sentence.
Five public government signals are treated as authoritative: SAM exclusions, FASCSA orders, SAM registration status, FAPIIS, and set-aside certifications. Those are lookup-backed. CMMC is not among them.
The product runs three streams over one obligation engine:
Assure (active awards, early access): continuous screening, with evidence on every check.
Prove (the record, early access): the evidence log, the audit trail, ISR/SSR-ready export.
Pursue (sought awards, in development): solicitation-derived requirement sets, and teammate pre-screen.
Assure and Prove are for work you already have. Pursue is for work you are trying to win. I built the first two. The third is not done.
What I chose to build first
I built Assure and Prove first because that is where the obligation already exists. Active awards create flow-down today. The evidence trail is what makes a check defensible later, when someone asks what you knew and when you knew it. Pursue can wait until that record is real.
Zero-custody was a constraint, not a slogan. Contract files are processed in the browser with pdf.js and mammoth. Raw bytes are never transmitted to AutoSAM servers. The product position is the one I will keep using:
We never touch your CUI. Contracts stay on your device. We record the diligence, not the artifact.
That decision has a cost. In-browser extraction is harder than uploading a PDF and running a server pipeline. I accepted it because CUI handling is not a feature you add after launch. If the product asked a prime to send contract files to a pre-launch application, I would not trust it either.
Invited subcontractors participate free. The obligation owner pays. I do not want AutoSAM to tax the companies being screened. That is an anti-tax design. It is also a slower way to grow a network, and I accepted that too.
A short engineering note
This is not the case study. A few decisions are worth naming because they are the product, not the scenery.
Zero-custody extraction still has to be good enough to derive flow-down when the artifact never leaves the device.
The flow-down engine is conditional: clause by sub by tier, with dollar thresholds, FCI and CUI flags, and commercial-item treatment. FAR, DFARS, and CFR text is not a checklist you stamp onto every name in a vendor list. If the engine cannot encode that, the evidence log is theater.
The evidence log carries provenance. A check that cannot say what was screened, against which source, at which time, is not diligence.
Architecture meta-tests enforce package boundaries and counsel-gated copy. Some sentences in this domain are legal risk if they drift. I would rather fail a build than publish a claim the product cannot stand behind.
The stack is the same family as the rest of my public work: Next.js 16, React 19, TypeScript, Mantine 8, Storyblok, Postgres with Supabase, and Drizzle. The personal site I described in Engineer Opportunity: Storyblok + Next.js + Mantine reference architecture is the same bet, at a smaller scale. AutoSAM is the large version of that bet.
The homepage already states the rest: 90 feature modules, 2,000+ automated tests, built solo in under a year, pre-launch and not yet publicly deployed. Those numbers belong in the case study. I mention them once so this page does not pretend the engineering record does not exist.
Status, August 2026
AutoSAM is pre-launch. The marketing site is live at autosam.io. The SaaS application is not publicly deployed. A founding cohort (12 seats: 7 Assure Prime I, 5 Consultant/RPO) and a design-partner program exist as reservations, not live billed accounts. Stripe is intended at general availability. It is not live.
CMMC Phase 2 arrives in November 2026. That date is why those reservations exist now, rather than as a waitlist dressed up as a product.
Where this leaves it
AutoSAM is a system of record for a verification obligation that has no government lookup. Assure and Prove are the parts I made real first. Pursue is next. The marketing site is public. The application is not.
If you want the product as it is presented to the market, go to autosam.io. If you want the build receipts, the engineering case study is on this site.
I will leave the claims in one place, so they cannot drift. No live customers. No revenue. Not a C3PAO. Not a guarantee. Not affiliated with SAM.gov or the U.S. Government. CMMC captured as sub-attestation with provenance. Five public signals treated as authoritative, and CMMC not among them.
That is where the work stands. The next work is launch, not another essay.