Trust & Assurance
Security, compliance and the evidence behind them.
How ARETE Strategy AI protects institutional data, governs technology-assisted analysis and stands against the standards our clients are accountable to.
How to read this page
Every control and standard below carries its status and the evidence behind it. A control marked verified is exercised by an executable acceptance test in the deployed application; a control established by reading the implementation says so; anything not yet built is stated rather than omitted. ARETE claims no certification it does not hold.
Security standards
Tenant isolation, identity and access, private evidence storage, separation of duties, audit integrity, governed AI, change control and continuity — each with the evidence behind it.
Regulatory compliance
How the platform and the company stand against the GDPR, the EU AI Act, DORA, NIS2, ISO/IEC 27001 and SOC 2 — including what has not been assessed.
Data protection
The privacy notice, its publication status and the processing, retention and transfer matters that still require verification.
AI transparency & responsible use
How technology-assisted output is produced, reviewed and limited, and which transparency obligations still require determination.
Regulatory intelligence disclaimer
The limits of platform output against official sources, supervisory communications and professional advice.
Confidentiality & intellectual property
How client, government, sovereign infrastructure and other sensitive engagement information is handled and protected.
Assurance posture at a glance
11
In place — verified by test
16
In place — inspection
1
Design intent — incomplete
8
Not implemented
These counts are derived from the controls published on the Security standards page. They describe the evidence held today — not a certification, and not an assurance opinion.
36 controls across 8 areas — read the security standards.
Certifications
No information-security certification is claimed. ARETE Strategy AI Ltd does not hold ISO/IEC 27001 certification, has not issued a SOC 2 report and has not been assessed by an independent assurance provider. Where an institution requires independent assurance, the control evidence behind each status on this page is made available for its own review.
Reporting a security concern
Security concerns, vulnerability reports and institutional due-diligence requests are directed to the security contact address and acknowledged by the company. Write to admin@aretestrategyai.org.