Security posture, stated plainly
This page separates what is implemented in the platform today from what is mapped but not yet audited. We would rather your security team find that distinction here than discover it in a questionnaire.
Certification status
ArchtSoft does not currently hold SOC 2 Type II or ISO 27001 certification, and we do not offer a HIPAA business associate agreement at this stage. Control mapping against those frameworks is complete and available for review, but mapping is not an audit and we will not present it as one. When an auditor is engaged we will publish the firm, the scope and the report date on this page.
What is implemented today
These are architectural properties of the platform, not policies written for a procurement pack.
Tenant isolation
ImplementedA three-layer tenant isolation model separating data, execution and access across every tenant boundary.
AI gateway chokepoint
ImplementedAll model calls route through a single gateway, giving one enforcement and observation point for every AI interaction in the platform.
Lineage recording
ImplementedDecision and generation lineage recorded against EU AI Act Article 12 logging and record-keeping requirements.
Threat model
ImplementedA STRIDE threat model covering 27 identified threats across 10 platform components, maintained as the architecture changes.
Security controls
ImplementedA NIST 800-53 Rev 5 control matrix covering 55 controls, with coverage scored and tracked rather than asserted.
Audit replication
ImplementedAn outbox pattern replicates audit records durably, so the audit trail does not depend on the primary transaction path.
Encryption
ImplementedTLS 1.2+ in transit and AES-256 at rest across managed storage and backups.
Durable execution
ImplementedAI workflows run on Temporal Cloud, so long-running generation is recoverable and auditable rather than best-effort.
Framework by framework
“Mapped” means controls are documented against the framework. “Roadmap” means the work is planned and the certification is not held.
| Framework | Status | Detail |
|---|---|---|
| GDPR | Mapped | Control mapping completed against GDPR requirements; data processing agreement available on request. |
| EU AI Act | Mapped | Article 12 logging and record-keeping designed into the AI gateway. High-risk obligations apply from December 2027. |
| SOC 2 Type II | Roadmap | Controls mapped. Audit not yet commenced — we will publish the report date when an auditor is engaged. |
| ISO 27001 | Roadmap | Control mapping completed against Annex A. Certification not yet held. |
| HIPAA | Roadmap | Assessed as applicable to healthcare deployments. No BAA offered at this stage. |
Under the EU Digital Omnibus agreed in 2026, high-risk obligations for Annex III systems apply from 2 December 2027 and Annex I systems from 2 August 2028. ArchtSoft's lineage recording is designed against Article 12 ahead of those dates.
Service commitments
Availability targets are agreed per contract rather than advertised. Enterprise agreements carry a written SLA with measurement method, credits and an escalation path. We will not publish an uptime figure the platform has not yet accumulated enough operating history to support.
- Written availability target agreed in the Enterprise agreement
- Durable AI workflow execution on Temporal Cloud
- Audit records replicated independently of the transaction path
- Backup and restore procedures documented and tested
- Incident response and notification process defined
- Named technical contact for Enterprise customers
What we can send your reviewers
Legal documents are available directly. Security material is shared on request so we know who holds it.
Security architecture overview
How tenant isolation, the AI gateway and audit replication fit together.
STRIDE threat model summary
Identified threats by component, with mitigations and residual risk.
Data processing agreement
Standard DPA covering processing roles, sub-processors and transfers.
Privacy policy
What we collect, why, and how long we keep it.
Terms of service
Commercial terms for platform access.
Reporting a vulnerability
If you believe you have found a security issue in ArchtSoft, contact us directly. We will acknowledge your report and keep you updated through to resolution, and we will not pursue action against good-faith research.
Bring your security questionnaire
We would rather work through it early than late. Send it over and we will complete it against what the platform actually does today.