Your FedRAMP trust center, ready for CR26.
TrustBox hosts the trust center FedRAMP's CR26 requires: your certification data as pages and as FedRAMP JSON, access for federal staff without a manual approval queue, and a record of who looked at what. You push your FedRAMP JSON. We run the rest.
Get your trust center- January 1, 2027CR26 becomes mandatory.
- August 1, 2027Your trust center must be live.
What agencies get
Access without waiting
Federal staff sign in with their work email, checked against CISA's list of federal .gov domains. No one has to approve them by hand.
Readable by people and machines
Every report is a readable page and the FedRAMP JSON it was built from, with an API for agency systems.
A log of every view
Who signed in, what they opened, and when, kept and summarized so you can hand it to FedRAMP when asked.
Checked before it's published
Every push is validated against FedRAMP's official CR26 JSON schemas, so what agencies see is in the format FedRAMP expects.
How it works
Tell us about your offering
Fill in the form below. We'll call to walk through your package and what CR26 asks of it.
We set up your trust center
It goes live at
yourname.tbox.page, an address you can share with agencies from day one.Point your own domain at it
Add a CNAME from a name like
trust.yourcompany.comtoyourname.tbox.page. We issue the certificate.
Get your trust center
Tell us a little about your company and we'll set up a call.