Security & Compliance

The artifacts procurement needs.

Every ARCG Systems customer can ask for, and receive, the security and compliance artifacts their legal team requires — in the format they expect.

Who this page is for. Procurement, legal, and security teams evaluating SourceDeck for mid-market and enterprise use. Every item below is a real artifact we will produce under a signed MSA. Artifacts marked in progress are on the current attestation roadmap; contact the Operator-tier team for current evidence and remediation commitments.
SOC 2 Type II · in progress

SOC 2 Type II attestation

Security · availability · processing integrity · confidentiality. Remediation phase targeting completion in FY2026. Interim: Type I available under NDA.

Request current status letter →
Live

Data Processing Addendum (DPA)

Standard DPA + GDPR / CCPA data-subject rights, data-transfer SCCs where applicable. Counter-signed within one business day of request.

Request signed DPA →
Live

MSA & SOW templates

Standard Master Services Agreement and statement-of-work template attached to every Operator proposal. Redline-friendly.

Request templates →
MedPilot vertical · in progress

HIPAA BAA

Business Associate Agreement for MedPilot deployments. Required before any PHI touches the platform. Limited availability in Operator tier; broader rollout after SOC 2 Type II.

Request BAA discussion →
Planned · FY2026 H2

FedRAMP-ready posture

Targeting FedRAMP Moderate equivalency for GovCon workloads. Currently tracked against NIST 800-171 and CMMC Level 2 controls under ARCG Systems as an SDVOSB.

Request current control matrix →
Live

Retention & deletion policy

Per-workspace retention. Workspace reset purges localStorage, cached analytics, saved campaign state. Full account deletion on request; 30-day verifiable purge window.

Public retention policy →
Scaffolded · shipping in Phase 2

Audit log

Every state change (approvals, secret reads, workspace mutations, webhook deliveries) written to an append-only audit log. UI surface in Phase 2; log schema already in SELF_SETUP_SQL_AND_API_SPEC.md §19.1.

Live

Security review questionnaire

SIG Lite, CAIQ, CIS, and custom vendor questionnaires. Turnaround ≤ 5 business days under a signed NDA.

Submit questionnaire →
Live

Subprocessor list

Current subprocessors — Stripe (billing), Cloudflare (edge + Workers), Postmark (transactional email), Basin (form intake), Tidio (chat). Full DPAs in place with each. Updated on change, notice-first.

Live

Insurance

General liability + professional liability + cyber liability. COIs issued per customer request within one business day.

Request COI →

What to expect on a procurement call

  1. Operator-tier scoping call within one business day of proposal request.
  2. Signed NDA routed via DocuSign within 2 business days; security pack released on receipt.
  3. Written proposal with DPA, MSA, SOW, and any requested compliance artifacts within 5 business days.
  4. Security-review questionnaire turned in ≤ 5 business days with evidence cited per control.
  5. Kickoff once signed; workspace provisioned via the activation flow.