Compliance and certifications

Current status against regulations and frameworks buyers ask about in diligence.

Regulated teams need clear status labels. Below is what is Compliant, Enterprise Plan, Via Payment Processors, In Progress, or Planned.

Regulatory status

GDPR

Compliant

European Union

GDPR practices for EU users. Details in /privacy.

  • Right to access personal data
  • Right to rectification and erasure
  • Data portability support
  • Privacy by design and default
  • Data processing agreements with vendors
  • EU representative appointed

CCPA

Compliant

California, USA

California Consumer Privacy Act practices.

  • Consumer rights notices
  • Do Not Sell My Personal Information option
  • Data deletion requests within 45 days
  • Privacy policy disclosure at /privacy
  • Opt-out for data sales where applicable

HIPAA readiness

Enterprise Plan

United States

HIPAA-oriented controls and BAA on Enterprise. Not a general HIPAA certification claim.

  • Business Associate Agreements (BAA) on Enterprise
  • PHI encryption and access controls (Enterprise HIPAA path)
  • Audit logging and monitoring
  • Breach notification procedures
  • Regular risk assessments
  • Workforce training programs

PCI DSS

Via Payment Processors

International

Card data handled by Stripe; Arvad does not store card numbers.

  • Payments via Stripe
  • No storage of card data on Arvad
  • Encrypted payment transactions via processor
  • Regular security scanning
  • Network segmentation
  • Periodic compliance reviews

Security frameworks

NIST Cybersecurity Framework

Controls mapped to Identify, Protect, Detect, Respond, Recover

  • Identify: Asset management and risk assessment
  • Protect: Access control and data security
  • Detect: Continuous monitoring and detection
  • Respond: Incident response planning
  • Recover: Recovery planning and improvements

CIS Controls

Center for Internet Security controls we use as a checklist

  • Inventory and control of hardware assets
  • Continuous vulnerability management
  • Controlled use of administrative privileges
  • Secure configuration for hardware and software
  • Maintenance, monitoring, and analysis of audit logs

Data residency

Choose where platform data is stored and processed when your plan supports it:

United States

Available
us-east-1 (Virginia)us-west-2 (Oregon)

European Union

Available
eu-west-1 (Ireland)eu-central-1 (Frankfurt)

Asia Pacific

Available
ap-southeast-1 (Singapore)ap-northeast-1 (Tokyo)

Canada

Coming Q1 2026
ca-central-1 (Montreal)

Audit and reporting

Audit logs

Audit logging for security-relevant activity:

  • Authentication and authorization events
  • Data access and modification tracking
  • API calls and system changes
  • 90-day retention with export

Compliance reports

Enterprise customers can request compliance documentation:

  • SOC 2 Type II materials when the audit completes (In Progress today)
  • Penetration testing summaries under NDA
  • Data processing agreements
  • Custom compliance documentation

Enterprise compliance support

Enterprise can add:

  • Custom compliance requirements
  • Dedicated compliance contact
  • Business Associate Agreements (BAA)
  • Custom data residency options
  • Extended audit log retention
  • Priority security support

Compliance questions

Ask for status letters, DPAs, or Enterprise documentation.

See also /security