This attestation covers Formation Ads's own systems, technology stack, hosting providers, and service integrations.
Scope Limitation
This Section 889 compliance attestation applies exclusively to Formation Ads's own infrastructure and systems. It does not extend to Meta Platforms, Inc. or any third-party advertising platform. Organizations must independently assess Meta's compliance status as part of their own procurement due diligence.
This is a limit on what Formation Ads can attest to — we cannot and do not attest on Meta's behalf — not a requirement to clear Meta before advertising through Formation. Under the Formation procurement path your contracting party is Formation Ads: the prime contractor, which provides a FAR 52.204-25 representation with every purchase (SAM.gov registration planned). Meta is the advertising platform your ads run on. How Section 889 applies to Meta as a downstream supplier is under legal review, and we can discuss it on request. Independently assessing Meta applies when you would procure advertising from Meta directly — the path Formation Ads exists to replace.
Overview
Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Public Law 115-232) prohibits the federal government from procuring or contracting with entities that use covered telecommunications equipment or services. The Federal Acquisition Regulation (FAR) implements this prohibition at 48 CFR 52.204-25.
Formation Ads is designed from the ground up to support organizations that operate under government contracting requirements, including full compliance with Section 889.
Our Compliance Commitments
No Covered Equipment
Our platform does not use any telecommunications or video surveillance equipment from covered entities in any component of our infrastructure.
Supply Chain Verification
All third-party service providers (Vercel, Neon, Stripe, Cloudflare, Resend, Sentry, Google (Places API), GitHub, Meta Platforms) are US-headquartered companies. Based on publicly available information and provider representations, we are not aware of any covered telecommunications dependencies.
Periodic Review
We re-check our service providers against the Section 889 prohibited list whenever we add a provider, and at least once a year.
Annual Attestation
We produce annual compliance attestation documents and maintain an append-only audit trail of all platform actions for government inspection. The database refuses edits and deletions.
US-Based Infrastructure
The application runs on Vercel in a US region, and the database runs on Neon in AWS us-west-2 (Oregon). Pages and uploaded media are delivered over Vercel's and Cloudflare's global networks. Every provider below is a US-headquartered company:
- Vercel: Application hosting, serverless compute and content delivery. United States.
- Neon: PostgreSQL database hosting. United States (AWS us-west-2).
- Stripe: Payment processing and invoicing support. United States.
- Cloudflare: Bot protection (Turnstile) and object storage (R2) for uploaded creative assets, generated reports and the encrypted weekly database backup. United States / global edge network.
- Resend: Transactional email delivery. United States.
- Sentry: Error monitoring, performance tracing and session replay. United States.
- Google (Places API): Venue location search (Places API). United States.
- GitHub: Source control, continuous integration and the weekly offsite database backup job (GitHub-hosted runners). United States.
The same providers, with what each one processes, are listed on the Subprocessors page, which is generated from the same list as this page and the attestation document.
Prohibited Entities
Section 889 applies to telecommunications equipment and services from the following entities and their subsidiaries or affiliates:
- Huawei Technologies Company(and subsidiaries/affiliates)
- ZTE Corporation(and subsidiaries/affiliates)
- Hytera Communications Corporation(and subsidiaries/affiliates)
- Hangzhou Hikvision Digital Technology Company(and subsidiaries/affiliates)
- Dahua Technology Company(and subsidiaries/affiliates)
Also includes any entity the Secretary of Defense determines is owned or controlled by the government of a covered foreign country.
Formation Ads does not use products, services, or components from any of these entities or their subsidiaries in any part of our infrastructure.
Regulatory References
| Reference | Description |
|---|---|
| FAR 52.204-24 | Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment |
| FAR 52.204-25 | Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment |
| Section 889, NDAA FY2019 | John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Public Law 115-232), Section 889 |
Generating Your Attestation
Organizations using Formation Ads can generate a formal Section 889 compliance attestation document through the platform dashboard. This attestation:
- Is Formation Ads' own Section 889 representation as the vendor, issued in your organization's name with the date it was generated and the person in your organization who requested it.
- Is signed by Formation Ads' authorized representative, not by anyone in your organization: a vendor representation is the vendor's statement. The signatory's name and title are printed on the document and bound into its content hash.
- Is available as a print-ready document suitable for inclusion in government contract submissions.
- Is recorded in the platform's append-only audit log with generation timestamp and signatory information. Once signed, the document record itself is locked: the database refuses any change to it or deletion of it.
Disclaimer
Formation Ads provides compliance tooling and attestation generation to assist organizations with their FAR 52.204-25 obligations. This does not constitute legal advice. Each organization is responsible for independently verifying its compliance with applicable regulations and contract requirements.
Compliance Verification
Compliance Team
For compliance questions, verification requests, or to report a concern, contact us at compliance@formationads.com.
We respond to all compliance inquiries within 2 business days.