Describe the Company
A URL and a short profile. ARIMA reads the site to learn what you sell, where you sell it, and whose data you hold.
Know exactly how audit-ready you are.
Give ARIMA your website and a short profile. It works out which regulations apply to you and shows what an auditor would find missing. It takes about five minutes, needs no credentials, and installs nothing.
Readiness · sample company
61
SOC 274%
GDPR66%
ISO 2700152%
HIPAA38%
The control graph
SOC 2 and ISO 27001 want the same thing.
So do GDPR and HIPAA, for much of the list. ARIMA maps each requirement to the clause it satisfies in every scored standard that asks for it, so one answer counts in all of them.
- Scope before questions
ARIMA uses your profile to work out which categories apply, so a company that doesn’t operate in Kazakhstan is never scored against Kazakh law.
- Every mapping cites its source
Each one names its source, the clause and who issued it. Rows still in draft stay out of your score.
- We won’t invent a number
Where ARIMA has no crosswalk for a standard yet, it links the source and leaves that standard unscored.
Do you enforce multi-factor authentication for everyone with production access?You answer this once.
SOC 2
CC6.1ISO 27001
A.5.17GDPR
Art. 32HIPAA
164.312(d)Most companies finish in about five minutes.
ARIMA reads your public website first and pre-fills what it finds for you to confirm.
Answer Only What Applies
The questionnaire drops whatever doesn’t fit you. A pre-revenue dev-tools team never sees the AML questions a payments company must answer.
Get Your Score and Fixes
A readiness score for each framework and a ranked list of what to fix first.
What you get
The work an auditor would make you do.
A Readiness Score You Can Defend
One number per framework, built from your answers, your site scan and your documents. Open it to see every control behind it.
Gaps in the Order to Fix Them
Ranked by severity and by how many frameworks each fix unblocks at once.
Fix Steps for Your Stack
On Google Cloud the steps name the exact setting, such as uniform bucket-level access, OS Login, or a firewall rule that leaves SSH open to the world.
Policy Drafts to Start From
The documents an auditor asks for, with the company details you entered already filled in.
Evidence Read for You
Upload a policy and ARIMA checks it against each control, including the ones it only appears to cover.
Read-Only Seats for Investors
Investors get a read-only view of your score and its trend. They never see your raw answers.
Coverage
Every standard we map, and how far we go with each.
44 standards across 9 domains. 28 have a crosswalk to their clauses and are scored. ARIMA cites the rest and links to their source, but does not grade them.
Security & Assurance
What buyers and auditors ask for first.
Privacy & Personal Data
Triggered the moment you hold a user record.
Financial, Tax & Trade
Money movement, cross-border sales, sanctions.
Corporate, People & IP
The diligence questions that stall a raise.
Corporate & Legalinternal baselineScored
Employment & HRinternal baselineScored
Trademarks15 U.S.C. ch. 22CitedSPDX licencesSPDX License ListCitedAI Governance
Rules for building and deploying AI, some with legal deadlines.
Platform & Distribution
If you ship an app, these gate the release.
Social & Sustainability
What enterprise procurement now asks for.
Kazakhstan
Local law, from the moment you have a user in Kazakhstan.
KZ Personal DataLaw No. 94-V ЗРК of 21 May 2013ScoredKZ PD Protection RulesOrder No. 179/НҚ of 12 June 2023ScoredKZ CybersecurityLaw No. 418-V ЗРК of 24 November 2015ScoredKZ Uniform RequirementsDecree No. 832 of 20 December 2016ScoredKZ Labour CodeCode No. 414-V ЗРК of 23 November 2015ScoredKZ Social CodeCode No. 224-VII of 20 April 2023ScoredKZ AI LawLaw No. 230-VIII ЗРК of 17 November 2025ScoredKZ Online PlatformsLaw No. 18-VIII ЗРК of 10 July 2023ScoredKZ Digital CodeCode No. 255-VIII ЗРК of 9 January 2026ScoredKZ Tax CodeCode No. 214-VIII ЗРК of 18 July 2025ScoredKZ Currency ControlLaw No. 167-VI ЗРК of 2 July 2018ScoredKZ Corporate (ТОО)Law No. 220-I of 22 April 1998ScoredKZ AML/CFTLaw No. 191-IV of 28 August 2009ScoredKZ Consumer RightsLaw No. 274-IV of 4 May 2010ScoredKZ AdvertisingLaw No. 508-II of 19 December 2003Scored
AIFC (Astana International Financial Centre)
A separate English-law jurisdiction inside Kazakhstan, with rules of its own.
Names are cited, not endorsed. Each standard belongs to its issuing body, and the marks beside them are ARIMA’s own drawings. No issuer has reviewed, certified or endorsed this product. ARIMA measures audit readiness; certification only comes from a qualified auditor or the relevant authority.
Who uses ARIMA.
Founders
You’re being asked for SOC 2 by a customer who won’t sign without it, and you have no idea what it costs you.
- Know where you stand before you pay an auditor
- One questionnaire for every framework that applies
- Fixes you can hand to an engineer
Investors
You want portfolio-wide risk without chasing twelve founders for a spreadsheet every quarter.
- Read-only seats across your portfolio
- Benchmarks shown only once five companies take part
- Change since each company’s last assessment
Consultants
You run readiness for a book of clients and redo the same intake for each one.
- Every client in one portfolio view
- Shared workspaces with per-client access
- The crosswalk does the mapping for you
Start with a URL.
It’s free to start and takes about five minutes, with no sales call. You leave with a score for each framework and a ranked list of what to fix.