Privacy

Effective October 9, 2026

Pragma FedRAMP is operated by Wentzel Investments LLC, a Florida limited liability company (“we”, “us”). It is a document-authoring workbench that helps a cloud service provider draft its own FedRAMP System Security Plan and work through an assessment with its 3PAO. This notice covers this site, pragma-fedramp.wentzel.ai: the public landing page and the signed-in workbench.

Who can sign in

Access is invite-only. You sign in with a Google Workspace account that we have admitted through an allowlist; there is no public sign-up, and password sign-in is turned off. If you only read the public landing page, you do not create an account and we do not ask for personal details.

What we collect

• Account details from your Google sign-in: your name, email address and profile image, plus the organization you belong to and your role in it (author, assessor or owner).
• Session records: a session identifier, its expiry, and the network address and browser user agent the session was opened from, so we can keep your sign-in secure.
• Workbench content you enter: system details, control implementation statements, evidence records (descriptions and references to the artifacts they point to), AI-drafted narratives and their approvals, assessment determinations, evidence requests, and POA&M items.
• Audit records: every draft, approval and assessment action is written to a per-organization, append-only audit chain that records who did what and when.
• Operational logs and error reports: short-lived request logs at our edge, and error reports sent to our error-monitoring provider with default personal data collection turned off and no session recording.

How AI drafting uses your content

When you ask for a draft, the implementation statement and the evidence you attached to that control are sent through our Cloudflare AI Gateway to Anthropic’s Claude model, which returns a draft narrative. Every draft lands as pending human approval; nothing is approved or exported without a person approving it. We do not use your content to train AI models.

How we use it

We use this information to run the workbench for your organization: to sign you in, keep each organization’s data separate, produce your drafts and OSCAL output, keep the audit trail, and find and fix faults. We do not sell personal information, and we do not use it for advertising.

Where it is processed

The service runs on Cloudflare (hosting, database, object storage and the AI Gateway). Sign-in is handled with Google, AI drafting with Anthropic, and error monitoring with Sentry. The workbench is a commercial service that helps you prepare your own authorization package; it runs on Cloudflare’s commercial network, not in a government cloud region, and is not intended for federal or controlled unclassified information.

Retention

Workbench content is kept while your organization uses the service. Audit-chain entries are append-only by design, so they are not edited or removed once written, including when the records they describe change. To ask about removing your account or your organization’s data, contact us below.

Cookies & consent

This site sets only the cookies it needs to work, chiefly the sign-in session cookie. It loads no advertising or social trackers. Your consent choice is stored in your browser so we do not ask again on every visit.

When a Cloudflare Web Analytics site id is configured for this deploy, this site loads that cookieless script (from static.cloudflareinsights.com) only after analytics consent is effective. It records the page you viewed, the referring page, your browser and device type, your approximate country, and page-load timings, and we see only aggregate counts. It sets no cookies and does not use your browser’s local storage.

The consent banner depends on the country your connection resolves to at our edge. In the EU/EEA, the UK and Switzerland (and when the country is unknown), it asks before any non-essential cookie or script would load. Elsewhere you receive notice and can opt out. We honor the Global Privacy Control (GPC) signal as an opt-out.

Your choices

You can ask to see, correct or delete the personal information we hold about you, subject to the audit-record limits above. Your organization’s owner controls the workbench content your organization enters.

Changes

If we change this notice, we will update it here and change the effective date above.

Contact

For a privacy question or a data request, email privacy@wentzel.ai. The organization-wide privacy notice is at wentzel.ai/privacy. See also our terms of use and accessibility.