Skip to content

FedRAMP Moderate Certified · SOC 2 Type II Attested · FIPS 140-3 validated encryption (Sharetru Federal) · U.S.-citizen staff

Request a demo

Run Sharetru alongside Microsoft 365 GCC High

Exchange CUI with partners who never need a seat in your tenant

Sharetru Federal runs beside GCC High as the governed way files get in and out.

  • Invite a prime or a supplier by link, or give their system an SFTP account; no seat in your tenant, ever
  • Sign in staff through Entra ID, partners with Sharetru credentials; no external identity enters your directory
  • Watch every transfer in your SIEM: Sentinel through a data collection endpoint, or any syslog target
  • Prove who moved what, when, with a per-file export your assessor can read
  • FedRAMP Moderate Certified (Class C)
  • CUI and ITAR workflows
  • Web application
  • HTTPS File Transfer API
  • SFTP · FTPS / FTPeS
  • Audit logs & retention
  • FIPS 140-3 validated encryption (Sharetru Federal)
  • Supports CMMC Level 2 workflows

The problem

Your exchanges happen at the edge of a tenant built for the people inside it

Every external exchange today is a guest ticket, a license, or an email with CUI attached. Three things go wrong when the exchange runs through a tenant built for one organization.

  • Provisioning

    A supplier needs a seat to receive a drawing

    So the ticket goes to the GCC High admins: cross-tenant B2B, a license, an eligibility check and an offboarding task nobody owns. The guest list outlives the contracts.

    Fixed by Links for people and SFTP accounts for systems; nobody is provisioned into GCC High

  • Workarounds

    So the files go out by email, or through an account nobody administers

    The partner routes around the enclave, and the CUI leaves with no record of who opened it. Your assessor asks exactly there.

    Fixed by Every transfer at the edge of the tenant logged per file, in and out

  • Scope

    Every workaround widens what the assessor has to look at

    A shared drive here, a personal account there, each one now holding CUI. Each becomes a system you have to describe and defend.

    Fixed by One more system to describe, not five: Sharetru Federal, with a FedRAMP package and a responsibility matrix behind it

Reference architecture

Where does Sharetru sit relative to GCC High?

Outside your tenant, inside the CUI boundary, as the one point where files cross the organizational edge. GCC High stays the enclave where your staff collaborate; nothing in it changes. Sharetru Federal is where files go in and out: partners by link, staff by the web app or SFTP, your own scripts by the API.

CUI / ITAR BOUNDARY OUTSIDE THE BOUNDARY Partners Primes Subcontractors Suppliers and vendors Consultants SHARETRU-NATIVE SIGN-IN No tenant accounts No guest licensing No vetting or offboarding queue CUI IN CUI OUT by link TO ENCLAVE FROM ENCLAVE STAFF web app, SFTP GOVPOINT FEDRAMP BOUNDARY INGRESS / EGRESS Hybrid authentication Managed file transfer File-level audit trail Admin-granted access YOUR MICROSOFT CLOUD · GCC HIGH AND AZURE INTERNAL ENCLAVE · MICROSOFT 365 GCC HIGH Where cleared staff collaborate Nothing here changes. No partner ever needs an account in it. Teams SharePoint OneDrive Exchange TENANT SERVICES SHARETRU USES Entra ID SSO for staff Sentinel Log forwarding Mail Microsoft 365 SMTP Azure Storage Push and pull via the Sharetru API SSO · LOGS · MAIL API · PUSH, PULL files, by your scripts ECO-rev-D ECO-rev-D RFQ-2291 RFQ-2291

Illustrative. Sharetru Federal is listed by name under Certified Services in FedRAMP package F1311222650, GovPoint Cloud Services by MIS Sciences Corporation, status FedRAMP Moderate Certified, Class C (FedRAMP’s current label; formerly Authorized): open the listing. It runs alongside GCC High, never inside your tenant. Sentinel forwarding and Microsoft 365 mail are built-in integrations; the Azure Storage path is your scripts calling the REST API, not a built-in connector. No files move over the identity, logs and mail connection.

  • Admin load

    Partners never enter the enclave

    No cross-cloud guest configuration, no per-external-user licensing, no eligibility check and offboarding task for every sub and supplier. Partners keep Sharetru-native credentials, so no external identity enters your directory.

  • Identity

    Hybrid authentication, chosen per user

    Entra ID replaces the Sharetru login for the staff you choose, on a commercial or a GCC High tenant: you build a security group, only its members can authenticate, and their MFA is your identity provider's. Everyone else, suppliers included, signs in to Sharetru with its own credentials, never to your tenant, and every grant beyond a first folder is assigned by an administrator.

  • Visibility

    External file movement lands in Sentinel

    Sharetru forwards its audit trail to Microsoft Sentinel as a syslog (CEF) stream, through a data collection endpoint in your workspace, a built-in integration with no middleware (confirmed for commercial Azure workspaces; Azure Government is checked with you on the call), so your security operations team watches the boundary from the same pane as everything else. Notifications to partners go out through your own Microsoft 365 mail domain.

What changes

What changes for the people who move the files?

People use links and the web app; systems use SFTP and the API. What that means for the ones who move the files, and for the bill.

  • Your scripts and your partners' systems keep their protocols

    SFTP, SCP, FTPS, FTPeS and HTTPS for the feeds you already run, and a 60-endpoint REST API for the rest. A partner's system gets an SFTP account with an SSH key and, on Complete, an IP rule; it counts as a registered user on your plan. A person using a link does not.

  • Nothing leaves without a record

    Every upload, download, view and permission change is logged per file, with the person or system, the time and the result. Logs stay 12 months on Sharetru Federal, and you can export them any time by API or through the SIEM integration.

  • Guests never take a paid seat

    Unlimited guests on every plan. A prime's engineer registers once with the address the link was sent to, a password and, on Sharetru Federal, an authenticator app, and sees only what was shared to them. The Federal package is $200 a month on top of the Core ($199 a month) or Complete ($499 a month) plan.

Before you ask

What you will find out on the call anyway

Said here first, so the call can be about your exchange and not about ours.

  • Is Sharetru a replacement for GCC High or SharePoint?

    No. GCC High stays the enclave where your staff collaborate; Sharetru Federal runs beside it and handles the exchange with outside parties, so they never need a seat in your tenant. Nothing moves between SharePoint and Sharetru on its own: staff carry files across through the web app or SFTP, and your scripts can move them through the API.

  • Does this work with a commercial Microsoft 365 tenant too?

    Yes. Entra ID sign-in works against a commercial or a GCC High tenant, and the parallel model is the same. Exchanges that carry CUI or ITAR data run on Sharetru Federal; everything else can run on Sharetru Commercial.

  • What does Sentinel actually receive?

    Every logged action (views, uploads, downloads, permission changes) as a syslog (CEF) stream, through a data collection endpoint in your workspace, with no middleware. Confirmed for commercial Azure workspaces; Azure Government is the first thing we check with you, and this page does not claim it. Any other SIEM takes the same stream as a syslog target.

  • How is Entra ID sign-in set up, and how does a partner's system authenticate?

    Through an enterprise app in your tenant, OAuth or SAML 2.0, scoped to a security group you choose. Each SSO user also has a Sharetru account. A partner's system authenticates to SFTP with an SSH key and, on Complete, an IP rule, and counts as a registered user on your plan; a person using a link does not.

  • How do our suppliers sign in, and will MFA slow them down?

    A supplier registers once with the address the link was sent to, a password and, on Sharetru Federal, an authenticator app. After that it is a link and a code. They see only what was shared to them, never the rest of your files, and never count against your plan.

  • Does Sharetru make us CMMC compliant?

    No vendor does. Sharetru Federal is FedRAMP Moderate Certified and takes responsibility for the controls that sit with the platform. The shared responsibility matrix says exactly which controls stay with you: the 30-minute review walks you through its family-level split, and the full matrix comes with a trial or a contract, under the NDA in the Terms of Service.

  • What does a demo involve?

    An hour in our Sharetru Federal demo environment, on sample files, with your scenario described in words: who sends what to whom. We play the supplier and the staff member live and open the record it produced. Entra ID and Sentinel are shown from the setup documentation; they are set up in your tenant once you go ahead.

  • How is Sharetru Federal priced?

    By registered users and storage on the Core ($199 a month) or Complete ($499 a month) plan, plus the Federal package at $200 a month. Plans run 12 months; guests are unlimited and never billed. Every new signup starts a 15-day free trial; the Federal environment is pre-configured rather than switched on, so ask for it on the form.

Next step

See Sharetru run alongside GCC High before you connect anything

An hour in our Sharetru Federal demo environment, on sample files, with your scenario described in words: who sends what to whom. We play the supplier and the staff member and open the record each step leaves behind. Entra ID and Sentinel are shown from the setup documentation, not connected; they are set up in your tenant once you decide to go ahead.

Need your security questionnaire answered in writing before anyone sees a demo? Book the 30-minute security and compliance review instead: send the questionnaire ahead, we walk through the SOC 2 report, the FedRAMP package and the responsibility matrix, and the answers come back in writing.

Request a demoAsk for the security reviewSee plans and start a trial

Demos run 60 minutes · The review runs 30 · Pick a time on the next page; nothing to install or connect for either

What happens next

  1. A supplier gets a link and sends a file in; no seat anywhere
  2. Staff take it into the enclave by the web app or SFTP, the same steps your people would follow
  3. The record is opened the per-file history your assessor will ask for, exported on the call