SOC 2 Type II
Audited annually by independent third parties. Controls covering security, availability, and confidentiality.
Security
Security and compliance, end to end.
Everything procurement, legal, and security teams need in one place.
Arena is built for enterprise from day one.
SOC 2
Type II audited annually
ISO 27001
Certified
HIPAA
BAAs available
Zero
Data used for training
Compliance & Certifications
Audited, certified, and renewed annually
ISO/IEC 27001
Certified information security management system. Continuous improvement cycle reviewed annually.
HIPAA
Compliant for protected health information. Business Associate Agreements available on all plans.
Annual Pen Tests
Independent penetration testing annually. Continuous vulnerability scanning. Responsible disclosure program.
Security Practices
Controls at every layer
Encryption
TLS 1.2+ in transit. AES-256 at rest. Customer-managed encryption keys (CMEK) on enterprise plans.
Access Control
Role-based access (RBAC), least-privilege enforcement, SSO (SAML 2.0), SCIM provisioning, MFA required.
Tenant Isolation
Logical isolation at every layer. No shared databases between tenants. Separate encryption keys per workspace.
Authentication
SAML SSO with Okta, Azure AD, Google Workspace, OneLogin. Multi-factor authentication enforced by default.
Monitoring & Audit
Full audit logs for every action. SIEM export available. 24/7 monitoring with automated alerting.
Vulnerability Management
Annual pen tests, continuous scanning, responsible disclosure program. 72-hour incident notification.
Privacy & Data Handling
Your data, your control
Arena processes data on your behalf. You own it, control it, and can delete it at any time.
Customer data ownership
You own all data. Arena processes as Data Processor under contract.
Data residency
US-based default. EU residency available. Additional regions on enterprise.
Data retention
Active for subscription life. Deleted within 30 days of termination.
No data sales, ever
Contractual commitment. Your data is never sold, shared, or monetized.
Subject rights
Access, correction, deletion, portability, honored within 30 days.
Data Controls
Encryption at rest
AES-256 ✓
Encryption in transit
TLS 1.2+ ✓
Tenant isolation
Logical ✓
External model training
Never ✓
Data residency
US / EU
AI & Your Data
How Arena's AI handles your data
Transparency about what happens with your data when AI features are active.
Never used to train external models
Contracts with model providers explicitly prohibit using your data for training. Zero exceptions.
Third party model usage is transparent
Zero-retention agreements with all AI providers. Your prompts and data are not stored by third parties.
Internal models: opt-in only
Arena's internal models train only on aggregated, de identified data, and only with your explicit opt-in.
Disable AI features at workspace level
Full control. Turn off AI processing for any workspace or data classification with one setting.
Ready to start the security review?
Our security team responds within 48 hours. Most procurement reviews close within one week.