SOC 2 Type II
An independent auditor tests how our controls operate over an observation window. The first report is the initial issuance of a rolling twelve-month report.
SOC 2 Type II and FedRAMP 20x Class C are in progress
Status
Private inference inside a compliance boundary
Open-weight language models on hardware we own. US-owned company, US-based staff, US datacenter, no foreign subprocessors, no prompt logging, no training on customer data.
A private inference endpoint
Platform details- Deployment
- Dedicated, on isolated GPUs
- Hardware
- Owned by ArcVault, in a US datacenter
- Retention
- Zero, by contract
- Prompt logging
- None
- Training on your data
- None
- Model versions
- Pinned
- Capacity
- Reserved rather than requested
- Support
- A named US engineer
The problem
- Security
- Every prompt leaves the building. Retention, logging and the subprocessor chain are set by the vendor and change without notice.
- Privacy
- PII, PHI and privileged material cannot cross into public inference. No standard agreement survives review by counsel who answers to a regulator.
- Provenance
- Frontier models change underneath the workload. When an examiner asks which model produced a decision in March, the version is gone.
- Cost
- Per-token pricing makes spend a function of usage nobody controls. It is repriced at the vendor’s discretion.
None of these are fixed by a better model.
How it works
What comes with the capacity
- Serving stack
- We tune the serving stack to your workload and maintain it against that workload.
- A named engineer
- A named US engineer is assigned to your deployment and answers the phone.
- Audit evidence
- Audit-ready evidence is delivered with the service.
- Pinned versions, reserved GPUs
- Model versions are pinned and GPUs are reserved, so costs stay predictable.
Buyers save a platform hire, a compliance project and a procurement cycle.
Compliance
Inference is a commodity. Authorization is not.
We are a compliance and privacy business that owns GPUs. The compliance boundary is the product.
FedRAMP 20x Class C
It covers controlled unclassified information against the Class C indicator set. The indicators are validated continuously by automation.
- Contractual zero retention
- Signed DPA and BAA
- US-only staff and hardware
- No foreign subprocessors