SOC 2 Type II
An independent CPA firm tests how a company’s security controls operate over time, then issues a report. We are preparing for our SOC 2 Type II audit.
Preparing for our SOC 2 Type II audit. Pursuing FedRAMP 20x Class C Certification.
Status
Private AI inference for regulated work.
ArcVault will run open-weight models on hardware we own in the United States. Your prompts will return to you and nothing will be kept. You will choose the models and the budget.
Service summary
Platform details- Deployment
- Private endpoint or metered API
- Hardware
- Owned by ArcVault, in US datacenters
- Data
- Returned to you, not stored
- Your prompts
- Never logged or used for training
- Models
- Your choice of open-weight models
- Model versions
- Pinned on private endpoints
- Capacity
- Reserved for private endpoints
- Support
- A named US engineer for private endpoints
For organizations that answer to a regulator
Health systems, banks, financial services firms, law firms, federal agencies and federal contractors hold data they cannot send to public inference.
- Security
- Public inference providers set their own terms for retention, logging and subprocessors, and they can change those terms.
- Privacy
- PII, PHI and privileged material carry legal duties. Every vendor that receives them needs terms your counsel will sign.
- Provenance
- Providers update and retire hosted models on their own schedule. An examiner who asks which model produced a decision last March expects a version number.
- Cost
- Spend follows usage, which is hard to forecast, and prices change at the provider’s discretion. Budget owners need a figure that holds for the year.
How it works
What you will get
- Owned and run in the US
- ArcVault is a US-owned company with US-based staff. Every request will run on servers we own in US datacenters, and private endpoints will get dedicated GPUs that no other customer shares.
- A named US engineer
- Each private endpoint will have a named engineer in the United States who tunes it to your workload and answers the phone.
- Evidence for your reviewers
- Every contract will include a signed data processing agreement, and private endpoints will add a business associate agreement where HIPAA applies. Before you sign, your reviewers will get the agreement templates, our security policies, an architecture diagram and a completed security questionnaire.
- Model choice and pinning
- You will choose the open-weight models you run. On a private endpoint, each version will stay pinned until you change it, so you can say which one produced any past output.
What we will offer
Metered API rates will be published per token, and each private endpoint will have a fixed price for its term.
- Metered API
- Pay per token for open-weight models shared across customers. Prompts and outputs will never be logged or stored.
- Private endpoints
- Run the models you choose on dedicated GPUs, with pinned versions and a named US engineer.
- Wholesale capacity
- Rent our servers or individual GPUs in US datacenters by the hour, or reserve them for a term.
- Agent hosting
- We will add it after launch.
Compliance
Inference is a commodity. Privacy is not.
Many providers run the same open-weight models, and the price keeps falling. The difference is who keeps your prompts and outputs. ArcVault will keep none of them, and our contracts will say so.
FedRAMP 20x Class C
FedRAMP is the federal government’s program for certifying cloud services for agency use. We are pursuing FedRAMP 20x Class C Certification.
- Contractual zero retention
- Signed DPA, BAA on private endpoints
- US-only staff and hardware
- No foreign subprocessors