Zero Compromises. Complete Transparency.

Arkose Labs holds the certifications and follows the controls our customers expect when entrusting their fraud and bot defense to a third party. Compliance is foundational to how we build, operate, and report.

Active Certifications & Attestations

• SOC 2 Type II — Annual independent audit covering Security, Availability, Confidentiality, and Privacy Trust Service Criteria.
• ISO/IEC 27001 — Information Security Management System certified to the international standard.
• ISO/IEC 27701 — Privacy Information Management System extension.
• PCI DSS — Where applicable for customers processing cardholder data, Arkose maintains supporting controls.
• GDPR & UK GDPR — Active data-protection program with EU/UK representative, DPIA support, and standard contractual clauses for international transfers.
• CCPA / CPRA — California Consumer Privacy Act and California Privacy Rights Act compliance.
• HIPAA — Customers in regulated healthcare verticals can engage Arkose under a Business Associate Agreement.

Security Standards

Arkose Labs designs its platform and operations to conform to industry-recognised security standards including ISO 27001, SOC 2 Type II, and CSA STAR. Our controls are assessed annually by independent third-party auditors. Copies of our most recent reports are available to customers under NDA upon request.

Privacy by Design

The Arkose platform is engineered to minimize personal data collection. Device signals are hashed on-device, payloads are pseudonymized in transit, and customer data is processed only in the regions you elect. We do not sell personal data. Ever.

Security Practices

• End-to-end TLS 1.3 in transit and AES-256 at rest.
• 24/7 security operations center with SIEM-correlated monitoring.
• Quarterly penetration testing by independent third parties; annual red-team exercises.
• Bug-bounty program for responsible disclosure of security issues.
• Background checks and least-privilege access for all employees handling customer data.

Customer Trust Resources

Active customers may request our most recent SOC 2 Type II report, ISO certificates, penetration test summaries, security questionnaire (CAIQ / SIG), and Data Processing Agreement under NDA. Contact trust@arkoselabs.com.

Reporting a Vulnerability

Please report suspected vulnerabilities to security@arkoselabs.com. We acknowledge submissions within 48 hours and operate a responsible-disclosure program.

Subprocessors & DPA

See our Sub-Processors list and Data Processing Agreement for the legal mechanisms that govern your data.

© 2026 Arkose Labs. All rights reserved.