Built to help you pass your audits.
We build and maintain the controls and evidence your auditors check, for SOC 2, ISO 27001, ISO 42001, MAS, DORA and the EU AI Act, and give your vendor review what it needs.
Built for your audits
The controls your auditor checks, built in and kept current.
These are your certifications and your audits. We design the AI systems we build to meet the controls behind them, keep those controls working, and produce the evidence when your auditor asks.
| Your audit | What your auditor checks | What we build and maintain |
|---|---|---|
| SOC 2 | Access control, change management, monitoring, incident response, vendor management. | SSO and least-privilege access, approved change logs, monitoring and alerts, incident runbooks. |
| ISO/IEC 27001 | Asset inventory, cryptography, logging, secure development, supplier relationships. | Asset and model inventory, encryption with your keys, tamper-evident logs, secure development records, supplier documentation. |
| ISO/IEC 42001 | AI risk and impact assessment, lifecycle controls, data quality. | Risk assessments, model cards, data lineage and change control for every model. |
| MAS TRM and Outsourcing | Technology risk controls and outsourcing due diligence. | Controls mapped to the guidelines, plus audit and access rights for you and MAS. |
| DORA | ICT risk management, the third-party register, resilience testing. | Register information, an exit plan, and disaster-recovery test results. |
| EU AI Act (high-risk) | Technical documentation, logging, human oversight, accuracy. | Documentation, logs and oversight records designed for Articles 9 to 15. |
Your auditor decides whether you pass. We make sure the controls work and the evidence is there.
Evidence
Ready when your auditor asks.
Evidence on request
Access reviews, change approvals, test results and recovery tests, exported in the format your auditor asks for.
Kept current
Quarterly access reviews, patching and re-testing are part of how we run the system, not a scramble before audit season.
Data residency
Your data stays under your controls.
When we deploy in your cloud, your data centre or an air-gapped network, your data never reaches our systems. It stays under your security controls and your own certifications.
Our engineers get access only when a task needs it, through your privileged-access tooling, and you keep the logs. Sub-processors: for client deployments in your environment, none. For our website and booking, see the sub-processor list.
For your review
What we provide.
Policies
Security policy summary, data-handling statement, sub-processor list and vulnerability disclosure policy.
Questionnaires
We complete SIG Lite, the CSA CAIQ, or your own questionnaire, including AI-specific addenda.
Contract terms
A data processing agreement and clauses for DORA Art. 30 and MAS outsourcing, including audit and access rights.
Resilience
Continuity and recovery plans with recovery targets and test results.
Exit
An exit plan, return of all data, models and code, and a deletion certificate.
Continuity
You own the weights and code from day one, subject to the base model’s licence. See how we choose base models. Runbooks let your team operate them without us.
Sub-processors
Who processes data for our website and booking.
These providers support arthiq.si, email and booking, as set out in our privacy notice. Client deployments in your environment use none of them for your data.
| Provider | Purpose |
|---|---|
| Cloudflare, Inc. | Website hosting, content delivery and security, and the database that stores assessment requests. |
| Amazon Web Services, Inc. (Amazon SES) | Sends the emails for assessment reports. |
| Cal.com, Inc. | Booking and scheduling. |
| Google LLC / Google Ireland Ltd (Workspace, Meet) | Email, calendar and video calls. |
| Google LLC / Google Ireland Ltd (Analytics) | Site analytics, only with your consent. |
| Railway Corporation | Hosts the server that runs our Umami statistics. |
Incidents
We tell you fast enough to meet your deadlines.
We notify you promptly of any suspected incident affecting your systems or data, within a timeframe written into our contract. Your own reporting deadlines include:
| Rule | Your deadline |
|---|---|
| MAS Notice 644 (technology risk) | 1 hour to MAS after discovering a relevant incident |
| DORA major ICT incident | Initial report within 4 hours of classification, and no later than 24 hours after becoming aware |
| GDPR Art. 33 | 72 hours to the supervisory authority |
Contacts
Who to talk to.
- Security · security@arthiq.co
- Data protection · privacy@arthiq.co
- Report a vulnerability · Responsible disclosure
Arthiq Tech Pte Ltd operates arthiq.si and arthiq.co.
Questions
What procurement asks.
Do you hold SOC 2 or ISO 27001 yourselves?
Arthiq is not yet SOC 2 or ISO/IEC 27001 certified. We build to those control sets, and our due-diligence pack shows the controls and evidence we have today. In most deployments the system runs in your environment, under your own audited controls, and we build and maintain the controls and evidence your auditors check.
Who are your sub-processors?
For client deployments in your environment, none. For our website and booking, see the sub-processor list. For the hosted option, we provide the list with the country for each.
What happens if Arthiq stops trading?
You already own the weights, code and data, and have runbooks to operate them.
What insurance do you hold?
Ask us for current cover and certificates as part of your review.
What we don’t promise
No borrowed badges.
- That working with us makes you certified. Your auditor decides; we make the evidence easy to produce.
- “Bank-grade security” or other badges with no evidence behind them.
- Our cloud providers’ certifications as if they were ours.
- Client logos without written permission.
Start your review.
Send us your questionnaire. We’ll return it with the due-diligence pack.