Security

Last updated: October 17, 2026

Manufacturers trust us with their quotes, orders, costs, and drawings, so we built Arzana to keep each customer’s data in its own environment and out of everyone else’s.

Request documents Email security

Compliance status

Status as of October 17, 2026

We publish where each program stands, with dates, and update this page as each one moves.

In progress
SOC 2 Type 1
Expected Q4 2026
Planned
SOC 2 Type 2
Expected 2027
In progress
ISO 27001
Expected 2027
In place
Continuous control monitoring in Vanta
Ongoing
In place
U.S. persons only, under 22 CFR 120.62
Ongoing
In place
AWS GovCloud (US) hosting for CUI, CMMC, and ITAR data
Available at no extra charge

Customers and prospects can request our security whitepaper and policies, and our SOC 2 report once it is issued, under NDA.

Your data stays yours.

Where it lives: A dedicated environment on AWS in the United States
Your data: Trains your agents only. Never another customer’s, never a public model
AI providers: Never receive it
Approval: Nothing goes out until your team approves it
Who can reach it: Only U.S. persons working in the United States
When you leave: A full export any time, and deletion confirmed in writing

Architecture and isolation

Every customer gets a dedicated, isolated database instance and its own encryption key on Amazon Web Services in the United States, so there is no shared database where one customer’s records sit beside another’s behind a filter. Application servers, databases, backups, replicas, and logs all stay in the United States.

Customer Data is encrypted at rest with AES-256 through AWS Key Management Service, using FIPS 140-2 validated modules, and in transit with TLS 1.2 or higher on every connection. Customers with CUI, CMMC, or ITAR obligations can be hosted in AWS GovCloud (US), the AWS partition approved for that data.

How our AI uses your data

What your agents learn from your quotes, orders, corrections, and feedback improves your environment only. Your data never trains, tunes, or informs a model or output for any other customer, and it is never pooled or benchmarked against anyone else’s.

The large language models we use run through Amazon Bedrock in our AWS account. Prompts built from your data, and the answers that come back, stay within AWS, are not sent to AI model providers, and are never used to train a third-party or public model.

The model, rules, and learned context built from your data live in your environment, serve only you, and are deleted with the rest of your data when you leave.

Integrations and approvals

You choose how much of your systems Arzana can touch, and a person on your team approves what the agents produce before it posts.

Email: Forward to a dedicated Arzana address, with no credential held by us; or a Microsoft 365 or Google Workspace connector scoped to the minimum permissions
ERP: No write access, with output delivered as an import-ready file; read-only access; or write access scoped to exactly the records each agent needs, with no delete, admin, or schema rights
Credentials: Stored in AWS Secrets Manager

The only connections that leave your environment are the ones you authorize to your own systems.

Identity, access, and people

Your team signs in with multi-factor authentication, which your administrator can require for every user, or through single sign-on over SAML 2.0 or OIDC at no extra cost. Users can be limited to specific divisions, regions, or product lines, and sign-ins, data access, exports, and configuration changes are logged with user and time and kept for at least 12 months.

On our side, administrative access to customer environments is limited to two named people, no change reaches a customer environment without a second person’s approval, and every access is logged in AWS CloudTrail. Everyone who can reach Customer Data, source code, or production systems is a U.S. person working in the United States, passes a background check, and completes security training on day one. When someone leaves Arzana, their access ends by the close of their last working day.

Monitoring, incidents, and availability

We log activity across our AWS environments with CloudTrail and monitor our controls continuously in Vanta. If we confirm a security incident that affects your data, we tell you within 72 hours what happened, what data was involved, and what we are doing about it.

We give at least 72 hours’ notice before scheduled maintenance.

When you leave, and who else touches your data

You can request a full export of your data, including inputs, outputs, configuration, and audit logs, in CSV or JSON at any time during your agreement and for 90 days after it ends, and we deliver it within 30 days. After that window, you can have everything deleted (raw inputs, generated outputs, learned context, your model, and backups), and we confirm the deletion in writing within 30 business days. If Arzana ever stops operating, you receive all your data within 30 days plus 90 days of transition help at no charge.

Amazon Web Services is the only subprocessor that stores or processes Customer Data. Any other system that touches your data is one you told us to connect.

Your part

A few controls sit with your team, such as keeping your user list current and reviewing work before you rely on it. Your responsibilities lists them.

Report a security issue

Email security@arzana.com to report a vulnerability or a security concern. We confirm we received your report and keep you posted as we work on it.