/////TRUST & COMPLIANCE
[SOC2 TYPE II]
ENTERPRISE TRUST CENTER
Trust, Security & Architecture Portal
Designed for technical evaluations & security reviews. Zero stored cloud access keys, read-only IAM connectors across AWS, Azure, GCP, and Kubernetes, and sovereign AP-SOUTH-1 data residency.
Capability & Compliance Status Matrix
Explicitly discriminates current implementation facts from roadmap items.
| Capability | Category | Current Status | Technical & Compliance Scope |
|---|---|---|---|
| AWS STS AssumeRole Cross-Account Integration | Security | OK Available | Read-only IAM AssumeRole delegation with external ID validation. |
| AES-256 KMS Envelope Encryption | Security | OK Available | AWS KMS customer-managed key envelope encryption at rest. |
| TLS 1.3 In-Transit Encryption | Infrastructure | OK Available | HTTPS TLS 1.3 enforced across all API routes and websocket streams. |
| AP-SOUTH-1 Mumbai Infrastructure Hosting | Infrastructure | OK Available | Hosted strictly in AWS AP-SOUTH-1 regional infrastructure. |
| DPDPA 2023 & GDPR Data Minimization Architecture | Compliance | OK Available | Architected for privacy alignment via zero credential storage & minimal metadata ingestion. |
| Immutable Cryptographic Audit Ledger | Governance | OK Available | Hash-chained append-only event ledger logging all detection and execution steps. |
| SOC 2 Type II Certification | Compliance | Planned | Independent third-party SOC 2 Type II audit planned for Q4 2026. |
| ISO 27001 Certification | Compliance | Planned | Information security management system certification roadmap. |
Explained Least-Privilege IAM Policy Inspector
Every permission requested is bound strictly to a specific waste detector feature.
sts:AssumeRoleFeature: Cross-Account IntegrationWhy requested: Generates temporary, short-lived security tokens for agentless scanning.
Impact if omitted: Agentless discovery fails; requires storing static IAM access keys (violates security policy).
ec2:DescribeVolumesFeature: Detector #102 (Unattached EBS Volume)Why requested: Inspects volume state (available/in-use) and attachment timestamp.
Impact if omitted: Unattached EBS waste detector cannot inspect block storage.
rds:DescribeDBInstancesFeature: Detector #104 (Idle RDS Instance)Why requested: Inspects database instance status, engine class, and endpoint identifiers.
Impact if omitted: Idle database waste detector cannot inspect RDS instances.
cloudwatch:GetMetricDataFeature: Resource Utilization TelemetryWhy requested: Retrieves 30-day P95 CPU, IOPS, and network throughput CloudWatch metrics.
Impact if omitted: Overprovisioned resource detectors cannot perform P95 utilization math.
Self-Describing Proof Assets Library
Technical evidence artifacts with explicit representation metadata.
Executive Multi-Cloud & AI FinOps Optimization ReportPDF
Demonstrates executive summary layout, spend breakdown, and monthly waste recovery roadmap across AWS, Azure, GCP, and K8s.
Representation: Representative Sample (Executive Audience)
Download PDF Asset →Cryptographic Audit Ledger ExportJSON
Illustrates JSON structure of hash-chained audit events, actor sign-offs, and state transitions.
Representation: Test Environment Output (Security Audience)
Download JSON Asset →AWS STS Least-Privilege IAM Policy TemplateJSON
CloudFormation / Terraform template defining exact AssumeRole read-only permissions.
Representation: Test Environment Output (Engineering Audience)
Download JSON Asset →Azure ARM Reader Least-Privilege Role DefinitionJSON
Bicep / Terraform definition granting read-only inspection across Azure Subscriptions and Management Groups.
Representation: Test Environment Output (Engineering Audience)
Download JSON Asset →GCP Workload Identity Least-Privilege BindingJSON
Terraform template configuring short-lived credential exchange for GCP Resource Manager and Compute viewer.
Representation: Test Environment Output (Engineering Audience)
Download JSON Asset →Kubernetes Read-Only ClusterRole ManifestJSON
Standard Kubernetes YAML manifest defining read-only ClusterRole for pods, PVCs, nodes, and daemonsets.
Representation: Test Environment Output (Engineering Audience)
Download JSON Asset →Multi-Cloud Agentless Architecture & Data Flow DiagramPNG
Visualizes network boundaries, AWS STS, Azure ARM, GCP Workload Identity, K8s RBAC, and AP-SOUTH-1 hosting.
Representation: Representative Sample (Engineering Audience)
Download PNG Asset →
Security & Compliance FAQs
Q: Does ArthaOps store long-lived AWS IAM access keys?
No. ArthaOps uses AWS STS AssumeRole cross-account delegation with External ID validation. Zero long-lived AWS access keys or secrets are stored in our systems.
Q: Where is customer telemetry data stored?
All telemetry metadata is hosted strictly in AWS AP-SOUTH-1 (Mumbai) infrastructure, encrypted at rest using AES-256 KMS keys and in transit via TLS 1.3.
Q: Can ArthaOps modify my production infrastructure during a preflight scan?
No. Preflight scans execute strictly within read-only IAM AssumeRole permissions (List* and Describe*). Zero production changes are made during preflight evaluation.