Skip to content
arcvault Systems

Compliance

Compliance status

We are preparing for our SOC 2 Type II audit. We are pursuing FedRAMP 20x Class C Certification. This page explains both programs and lists our data handling commitments.

Status

Program Status What it is
SOC 2 Type II Preparing An independent CPA firm tests how a company’s security controls operate over time
FedRAMP 20x Class C Pursuing The federal government’s program for certifying cloud services for agency use

SOC 2 Type II

A SOC 2 report is issued by an independent CPA firm after it examines a company’s controls against the AICPA Trust Services Criteria.

A Type I report describes controls at a single point in time. A Type II report tests whether those controls operated effectively across a period of time, called the observation window. The auditor samples evidence from the whole window, and the report states the dates it covers. A control that held in the first month and failed in the third appears in the report as an exception.

We are preparing for our SOC 2 Type II audit.

FedRAMP 20x Class C

FedRAMP is the federal government’s program for certifying cloud services for agency use.

We are pursuing FedRAMP 20x Class C Certification.

Data handling

The metered API and private endpoints will be return-to-source: each response goes back to the system that sent the request, and no prompt or output is stored on our side. Inference will be stateless.

  1. Data arrives
  2. It is processed
  3. No content is kept

Prompts will not be logged, so there will be no prompt log for anyone to subpoena. Customer data will never be used for training.

For each request, we will keep metadata only: the account and API key that sent it, the time, the model and version, the input and output token counts, a request ID, the response status and latency, and the source IP address. We will use it for billing, support and security, and delete it after 90 days. It will never include prompts or outputs.

Privacy commitments

  • Contractual zero retention
  • Signed DPA, BAA on private endpoints
  • No prompt logging
  • No training on customer data
  • US-owned company
  • US-based staff
  • US datacenters, on hardware we own
  • No foreign subprocessors

Security documentation

Security reviewers and counsel can request our security documentation or send questions to contact@arcvault.ai. The documentation includes the DPA and BAA templates, our security policies, an architecture diagram and a completed security questionnaire.

Request security documentation