Standards.
Compliance Matrix

Because Aradia systems operate locally behind the client's firewall, enterprise Vendor Risk Management (VRM) audits are radically simplified. There is no third-party cloud data processing agreement (DPA) required for inference, eliminating supply-chain exposure across SOC 2 Trust Services Criteria (Security, Confidentiality, Processing Integrity, and Privacy).

Engineered to Prevent Inadvertent Third-Party Waiver Under ABA Model Rule 1.6(c): American Bar Association Model Rule 1.6(c) mandates that lawyers make reasonable efforts to prevent the unauthorized access or disclosure of confidential client data. By eliminating third-party cloud data transmission, multi-tenant caching, and vendor telemetry, Aradia ensures confidential legal work product remains strictly within the firm's sovereign custody.

• +Attorney-Client Privilege Protection: Sovereign local execution ensures litigation strategies, contracts, and deposition summaries remain protected under the attorney work-product doctrine, with zero third-party cloud exposure that could be argued as waiver (see United States v. Heppner, S.D.N.Y. 2026).
• +GDPR & CCPA/CPRA Compliance: Absolute data residency. Zero international data transfers (GDPR Chapter V), no third-party data selling/sharing, and 100% local Right-to-Erasure execution.
• +Sarbanes-Oxley (SOX Section 404 & 802): Internal financial records processed by private analyst agents retain verifiable, tamper-evident audit trails on local write-once storage.

Financial institutions, wealth managers, and private family offices must safeguard Nonpublic Personal Information (NPI) under the Gramm-Leach-Bliley Act (GLBA) and international operational resilience mandates:

• +GLBA Safeguards Rule: NPI is processed strictly within private enclaves, eliminating cloud data leakage to public AI providers.
• +EU Digital Operational Resilience Act (DORA): Sovereign on-premise compute mitigates ICT concentration risk by eliminating operational dependency on single-point-of-failure cloud AI infrastructure.
• +SEC 17a-4 & FINRA 4511: Agent workflows can integrate with local WORM (Write Once, Read Many) archival storage for compliant electronic record-keeping.

HIPAA & HITECH Act Security Rule: On-premise DGX hardware guarantees that Protected Health Information (PHI) and electronic PHI (ePHI) never exit the covered entity's physical premises.

• +BAA Elimination / Simplicity: Because zero PHI is transmitted to Aradia or third-party cloud LLM APIs, the attack surface and vendor liability overhead are completely eliminated.
• +HITRUST CSF Alignment: Hardware and runtime controls align directly with HITRUST access control, endpoint security, and data protection specifications.
• +FDA GxP & 21 CFR Part 11: Pharmaceutical research and clinical triage agents operate with deterministic seeds, producing auditable, reproducible AI outputs for regulatory filings.

Municipalities, public safety agencies, and government contractors handling sensitive Criminal Justice Information (CJI) or state records:

• +FBI CJIS Security Policy (v5.9): Physical appliance placement inside municipal data centers supports the physical and network isolation requirements for local civic workloads by avoiding unaccredited multi-tenant commercial clouds, aligning with CJIS Area 5 (Physical Protection), Area 6 (Personnel Security), and Area 10 (System and Information Integrity).
• +Zero Persistent Access / Supervised Remote Maintenance: Aradia personnel have zero persistent network access. On-demand maintenance sessions require client-authorized initiation via outbound WireGuard tunnel and are strictly restricted to container runtime health, with zero vendor access to stored judicial or criminal justice records.
• +StateRAMP & FedRAMP High Alignment: Supports physical and network isolation requirements for local civic workloads by avoiding unaccredited multi-tenant commercial clouds.

The EU AI Act classifies obligations by use case, not hosting location. A high-risk application carries the same deployer duties whether the model answers from a rack you own or a vendor API you rent. What sovereign deployment genuinely changes is evidence and dependency: you control the logs, model versions, and data paths your documentation describes, instead of negotiating them with a provider.

• +Logging (Art. 26, six-month minimum): Every prompt, completion, and configuration change writes to an immutable local audit store on the client's own retention policy, flowing directly into their SIEM — not a vendor export window.
• +Technical documentation (Art. 11 / Annex IV): Version-pinned model weights with SHA-256 provenance, disclosed quantization methods, and change-controlled configurations give the client a stable assessment object — API models mutate underneath their documentation.
• +Human oversight (Art. 14) & transparency (Art. 13 / 50): Deterministic, interpretable local inference with explicit AI-interaction disclosure built into the runtime — users always know they are working with an agent.
• +Post-market monitoring (Art. 72): Performance benchmarking and incident observation run as internal observability tooling rather than log-access negotiations with a cloud vendor.

The AI Act and GDPR are assessed together in practice. Cloud inference under US jurisdiction layers statutory compelled-disclosure regimes — the CLOUD Act (18 U.S.C. 2703), FISA Section 702, and Patriot Act provisions — that require no EU court order and trigger no prior notification. Contractual data-residency clauses do not override these obligations. Local zero-egress inference removes the entire transfer-analysis layer from the combined review:

• +Chapter V transfers: Zero international inference transfers; data residency is architectural, not contractual.
• +Sub-processor register: A fixed local stack with no hidden API sub-processors turns the recurring re-review workstream into a version-pinning decision.
• +Data subject rights: Right-to-erasure, access, and rectification execute 100% locally under the client's own deletion workflow.

The Commission's Cloud Sovereignty Framework rates cloud and AI offerings at SEAL levels 0-4 by sovereignty assurance, with SEAL 3-4 as the procurement target for personal data, medical records, and national-sensitivity workloads. Contractual residency commitments cannot reach the upper tiers because statutory compelled disclosure overrides contract language. A client-operated appliance on client metal, administered by the client's own entity, is the architecture that supports the SEAL 3-4 posture — and sovereign on-premise compute also mitigates the ICT concentration risk that EU DORA targets for financial entities.