Audit-ready from day one.
For federal, defense and state contractors and subcontractors, and for public bodies such as agencies, municipalities and public authorities. Every change is logged, records export in an agency-ready package, the schedule follows strict finish-to-start rules, each contract deliverable has an owner and a date, readiness against the CMMC controls is tracked with evidence, and the capture pipeline sits beside the delivery work. Every AI feature can run on a model your own organisation operates.
33 tools switched on for this trade at setup. Untick any you don't need.Default project tabs
RAID replaces Capacity: a public programme is managed through its risks, assumptions, issues and decisions as much as its tasks.
Projects created on day one
- Programmes
- Contracts & Deliverables
- Capture
The three that do the heavy lifting.
Choose this industry during setup and its tools are queued for you. Review the list, drop anything you don't want, and the workspace initialises with the rest already working - or install any one of them on its own, later, from the marketplace.
Contract Deliverables
CDRLs and other contract deliverables with due dates or schedules, owners, submissions, acceptance and an audit trail, on the project or across the workspace.
- A deliverable code, contract reference and owner
- Once, weekly or monthly, the next instance made on acceptance
- Submitted, accepted or rejected, with notes
- Reminders before the due date
CMMC Readiness
Readiness tracking for the CMMC controls: status, owner, evidence and reviews for each control, and readiness by domain. It tracks your preparation; it is not a certification.
- Every control with a status and an owner
- Evidence attached to the control
- Review dates and reminders
- Readiness by domain at a glance
Records Export
Export a project's records for an audit, a client or a records request, as a PDF and structured JSON with a content checksum, with a FOIA package format for public bodies.
- A register of requests, tracked as work
- One-click packaging of a project's history
- A PDF plus structured JSON
- A content checksum on the package
What changes, in the hours it actually changes.
Three moments from an ordinary week. Every one of them is a thing the product does, not a thing it could be configured to do one day.
08:30
the deliverable due Friday has an owner and a history
Contract Deliverables lists each CDRL and every other deliverable with its contract reference, due date or schedule, owner, submissions and the government's acceptance or rejection. A recurring monthly report creates its next instance when this one is accepted, and the owner is reminded before it is due.
11:00
the proposal answers every requirement it has to
Quotes & Proposals keeps a compliance matrix beside the proposal: each requirement from the solicitation mapped to the section that answers it, with the unmapped count in front of you. The capture pipeline is the CRM, so the opportunity, the proposal and the delivery project are one record trail.
15:30
the auditor asks, and the answer is an export
Records Export packages a project's history as a PDF and structured JSON with a checksum, in a FOIA package format for public bodies. The Compliance Audit Logger is append-only, enforced by the database, and exports on demand. CMMC Readiness shows status, owner, evidence and the last review for each control, grouped by domain.
These sit on top of the whole product.
- The Compliance Audit Logger is append-only: the database refuses updates and deletes, for every role, and the log exports as CSV or JSON
- A meeting in a public-sector workspace is read as a public record: the motion in the words it was moved, the mover and seconder, the vote, the quorum and any recusal, each anchored to a sentence somebody said
- Advanced RBAC keeps a register of outside guests with field-level view and edit rules for them, enforced on the server
- RFI Workflows numbers each request per project, shows its age and whose answer it waits on, and runs it to closed
- The Risk Register sits on every programme, and the Timeline's strict finish-to-start rule refuses a move that breaks a dependency
- Time Tracking & Billing keeps defensible timekeeping against each contract line, and Training records the mandatory courses with credentials that warn before they lapse
- The Vendor Register holds every subcontractor and supplier with its contract dates; Public Read-Only Boards publishes a sanitised programme board at a public link
- Private AI: on the Business plan, point every AI feature at an OpenAI-compatible model your organisation operates, with a killswitch that never falls back to ours
- Every workspace also gets the core: Announcements, Forms, Polls & Surveys, Kudos, Standups, Approvals, Checklists & SOPs, Recurring Tasks, the Decision Log, the Timeline, Hands-On Scheduling, Notes, the Corkboard, the Handbook, the Policy Library, Structures, Navalo Signatures, Conversation Stats and Budgets
The honest edges.
- CMMC Readiness tracks your preparation. It is not a certification, an assessment or a guarantee of one, and Navalo is not a certified assessor.
- Navalo holds no FedRAMP, StateRAMP, CMMC or SOC 2 authorisation and does not claim one.
- A FOIA package inlines meeting summaries and action items, not full transcripts.
- Advanced RBAC sets field-level rules for outside guests on its own surfaces. It is not a field-level permission layer over every board in the product.
- Private AI decides which model reads your text. It is not database encryption: transcripts and summaries are stored as ordinary text either way.
How Government & Public Sector actually runs.
Each of these is a project in Navalo - its own board, tab strip, meetings, calendar and members. They are not pre-built modules and we will not pretend they are: what the industry gives you is the right defaults around them.
Built for the way your trade actually runs.
The ones buyers ask first.
Does CMMC Readiness make us compliant?
What is in a records export?
Do our records have to go to a commercial AI service?
Can an administrator edit the audit log?
Open a workspace that already knows Government & Public Sector.
Answer what your organisation does, review what gets installed, and start with the boards, meetings, chat and calendar already in the right shape.
Free to start · No credit card required