/////TRUST & COMPLIANCE
[SOC2 TYPE II]
ENTERPRISE TRUST CENTER
Trust, Security & Architecture Portal
Designed for technical evaluations & security reviews. Zero stored cloud access keys, read-only IAM connectors across AWS, Azure, GCP, and Kubernetes, and sovereign AP-SOUTH-1 data residency.
Compliance BaselinePlanned Q4 2026
SOC 2 Type II
13,056 Invariant Security & Boundary Tests Passing
Execution BoundaryAudited Constraint
100% Read-Only
Strict List* & Describe* connectors; 0 write privileges
Credential VaultZero Storage
0 Stored Keys
Ephemeral STS AssumeRole, Azure ARM & GCP WI tokens
Data ResidencySovereign Cloud
AP-SOUTH-1
Mumbai data isolation with AES-256 KMS envelope encryption
ASSURANCE LEDGER
Capability & Compliance Status Matrix
Explicitly discriminates verified production implementation facts from forward roadmap commitments.
| Capability | Category | Current Status | Technical & Compliance Scope |
|---|---|---|---|
| AWS STS AssumeRole Cross-Account Integration | Security | OK Available | Read-only IAM AssumeRole delegation with external ID validation. |
| AES-256 KMS Envelope Encryption | Security | OK Available | AWS KMS customer-managed key envelope encryption at rest. |
| TLS 1.3 In-Transit Encryption | Infrastructure | OK Available | HTTPS TLS 1.3 enforced across all API routes and websocket streams. |
| AP-SOUTH-1 Mumbai Infrastructure Hosting | Infrastructure | OK Available | Hosted strictly in AWS AP-SOUTH-1 regional infrastructure. |
| DPDPA 2023 & GDPR Data Minimization Architecture | Compliance | OK Available | Architected for privacy alignment via zero credential storage & minimal metadata ingestion. |
| Immutable Cryptographic Audit Ledger | Governance | OK Available | Hash-chained append-only event ledger logging all detection and execution steps. |
| SOC 2 Type II Certification | Compliance | Planned Q4 2026 | Independent third-party SOC 2 Type II audit planned for Q4 2026. |
| ISO 27001 Certification | Compliance | Planned Q4 2026 | Information security management system certification roadmap. |
LEAST-PRIVILEGE TRANSPARENCY
Explained Least-Privilege IAM Policy Inspector
Every permission requested is bound strictly to a specific waste detector feature with zero write privileges.
sts:AssumeRoleCross-Account IntegrationWhy requested:Generates temporary, short-lived security tokens for agentless scanning.
Impact if omitted:Agentless discovery fails; requires storing static IAM access keys (violates security policy).
ec2:DescribeVolumesDetector #102 (Unattached EBS Volume)Why requested:Inspects volume state (available/in-use) and attachment timestamp.
Impact if omitted:Unattached EBS waste detector cannot inspect block storage.
rds:DescribeDBInstancesDetector #104 (Idle RDS Instance)Why requested:Inspects database instance status, engine class, and endpoint identifiers.
Impact if omitted:Idle database waste detector cannot inspect RDS instances.
cloudwatch:GetMetricDataResource Utilization TelemetryWhy requested:Retrieves 30-day P95 CPU, IOPS, and network throughput CloudWatch metrics.
Impact if omitted:Overprovisioned resource detectors cannot perform P95 utilization math.
SOVEREIGN ATTESTATION
Out-of-Process Daemon & Cryptographic Integrity
ArthaOps remediation executions occur strictly via isolated local execution daemons communicating over secure UNIX domain sockets.
Socket BoundaryLocal UNIX Socket at 0660 permissions; strict UID/GID validation
Tamper-Evident AuditSHA-256 hash-chained append-only event ledger logging every action
Zero PII AccessOnly infrastructure resource metadata & metric data points are ingested
EVIDENCE REGISTRY
Self-Describing Proof Assets Library
Verified technical evidence artifacts with explicit representation metadata for diligence teams.
Executive Multi-Cloud & AI FinOps Optimization Report
PDFDemonstrates executive summary layout, spend breakdown, and monthly waste recovery roadmap across AWS, Azure, GCP, and K8s.
Download PDF AssetCryptographic Audit Ledger Export
JSONIllustrates JSON structure of hash-chained audit events, actor sign-offs, and state transitions.
Download JSON AssetAWS STS Least-Privilege IAM Policy Template
JSONCloudFormation / Terraform template defining exact AssumeRole read-only permissions.
Download JSON AssetAzure ARM Reader Least-Privilege Role Definition
JSONBicep / Terraform definition granting read-only inspection across Azure Subscriptions and Management Groups.
Download JSON AssetGCP Workload Identity Least-Privilege Binding
JSONTerraform template configuring short-lived credential exchange for GCP Resource Manager and Compute viewer.
Download JSON AssetKubernetes Read-Only ClusterRole Manifest
JSONStandard Kubernetes YAML manifest defining read-only ClusterRole for pods, PVCs, nodes, and daemonsets.
Download JSON AssetMulti-Cloud Agentless Architecture & Data Flow Diagram
PNGVisualizes network boundaries, AWS STS, Azure ARM, GCP Workload Identity, K8s RBAC, and AP-SOUTH-1 hosting.
Download PNG Asset
QUESTIONS & CLARIFICATIONS
Security & Compliance FAQs
Institutional questions addressed directly for technical evaluators, CISOs, and lead architects.
No. ArthaOps uses AWS STS AssumeRole cross-account delegation with External ID validation. Zero long-lived AWS access keys or secrets are stored in our systems.
Ready for an In-Depth Architecture Review?
Our engineering leadership conducts interactive security reviews, policy walkthroughs, and custom connector scoping with your infosec team.
Schedule Architecture & Security Review