Trust
Trust & Security
ArkComply is an ICT third-party provider to regulated firms. Before you contract with us, you are required to assess us. This page is written to answer that assessment.
Where your data lives
Hosted on AWS in the European Union (eu-west-1). Data residency is committed contractually: your data does not leave the EU.
Self-hosting is available. If your policy requires it, ArkComply can be deployed inside your own infrastructure.
Encryption and access
Encrypted in transit and at rest.
Role-based access control, granular by function. Users see only what their role entitles them to. External auditors can be granted read-only access to the record without the ability to modify it.
Sub-processors
- Amazon Web ServicesHosting and storage (EU)
- PostmarkTransactional email
- OktaAuthentication
Security and assurance
Our infrastructure runs on AWS in the EU, which holds ISO 27001, SOC 1/2/3 and ISO 27017/27018. Those certifications cover the infrastructure layer; ArkComply's own ISO 27001 and SOC 2 certification is on the roadmap, and we're happy to share where we are on request.
Independent penetration testing is scheduled as part of our assurance programme. The summary will be available under NDA during diligence.
Getting your data out
No lock-in. On exit you receive a complete archive: every uploaded artefact (policy documents, evidence, attachments) plus a CSV export of all completed controls and recommendations.
Business continuity
Backups run hourly, and the database is continuously archived using write-ahead logging, so recovery is point-in-time rather than to the last backup. Recovery point objective: five minutes. Recovery time objective: four hours.
For self-hosted deployments, recovery objectives are set by your own infrastructure and operations.
Data processing agreement
A standard DPA is available and ready to sign. Request it with your demo or at any point during evaluation.
Company
ArkComply is operated by Novola SAS, registered in France and founded in 2023. Independently owned and bootstrapped. All data processing takes place in the European Union.
