Question 1

Is a HIPAA BAA available?

Accepted Answer

Yes — on Enterprise tier. Contact privacy@simplification.io. BAAs cover PHI processed through ARIA's regulated data paths only; general knowledge-base content remains under the standard DPA.

Question 2

What is ARIA's PCI DSS scope?

Accepted Answer

ARIA does not store, process, or transmit primary account numbers. Payments are handled by Stripe via hosted fields. Our environment is PCI DSS SAQ-A scoped.

Question 3

When will ARIA be ISO 27001 certified?

Accepted Answer

Gap assessment completed Q1 2026. Stage-1 audit targeted Q3 2026, certification targeted H2 2026.

Question 4

Is ARIA SOC 2 Type II?

Accepted Answer

Observation window opened Q1 2026. Report expected Q3 2026. Type I bridge letter available on request.

Framework	Status	Notes
SOC 2 Type II	In progress	Observation window Q1 2026; report Q3 2026.
ISO 27001	Roadmap	Gap assessment complete; certification H2 2026.
HIPAA	BAA available	Enterprise tier; PHI-path isolation.
PCI DSS	SAQ-A	Stripe hosted fields; no card data on ARIA.
GDPR / CCPA / PIPEDA / UAE-PDPL	In production	See Data Protection page.
EU AI Act	Art 13 conformant	See AI Governance page.

Compliance

Framework coverage

Audit artefacts on request