Describe the company
A URL and a short profile. ARIMA scans the site and infers what you do, where you sell and whose data you touch.
9 scored25 mapped to their source
Know exactly how audit-ready you are.
ARIMA reads your company, works out which regulations actually apply to it, and shows you the gaps — in plain English, in about five minutes. Answer a requirement once and it counts everywhere it's asked.
- No cloud credentials
- No agent to install
- Free to start
Readiness — sample company
61
SOC 274%
GDPR66%
ISO 2700152%
HIPAA38%
Readiness, not certification — ARIMA never claims you are compliant.
Every standard ARIMA maps, cited to its issuing authority
SOC 2
ISO 27001
HIPAA
PCI DSS
GDPR
CCPA / CPRA
FERPA
BSA / AML
EU VAT
Sales-tax nexus
OFAC
EAR
Corporate & Legal
Employment & HR
Trademarks
SPDX licences
EU AI Act
NIST AI RMF
ISO 42001
App Store
Google Play
Meta Platform
Modern Slavery
GHG Protocol
CSRD / ESRS
The control graph
Answer once. Satisfy many.
Frameworks overlap far more than they differ. ARIMA holds one graph of controls, and every crosswalk row ties a requirement to the clause it satisfies in each standard — so a single honest answer moves all of them.
- Scope before questions
ARIMA first decides which of eleven categories apply to you, and why. You never answer for a regulation you aren't subject to.
- Every mapping cites a primary source
Not a blog post or a model's guess: the regulation, the clause, the issuing body. Mappings a human hasn't verified are kept out of your score.
- We won't invent a number
Where a verified crosswalk doesn't exist yet, ARIMA tells you the standard applies and points you at the source — and scores nothing.
Do you enforce multi-factor authentication for everyone with production access?Asked once, in plain English.
SOC 2
CC6.1ISO 27001
A.5.17GDPR
Art. 32HIPAA
164.312(d)How it works
Three steps, about five minutes.
No credentials to hand over, nothing to install. ARIMA works from what your company already looks like from the outside, plus what only you can tell it.
Answer only what applies
The questionnaire prunes itself to your surface. A pre-revenue dev-tools team never sees the AML questions a payments company must answer.
Get gaps, fixes and drafts
A readiness score per framework, gaps ranked by impact, remediation for your stack, and the policy drafts to close them.
What you get
The work an auditor would make you do.
Readiness is only useful if it tells you what to change next. Everything here points at an action.
A readiness score you can defend
One number per framework, built from your answers, your site scan and the documents you upload — with every control that fed it shown underneath.
Gaps ranked by what bites first
Not an undifferentiated checklist. Gaps are ordered by severity and by how many frameworks each one unblocks at once.
Remediation written for your stack
Tailored fixes generated for the tools you actually run, instead of the generic 'implement access control' line every template gives you.
Policy drafts to start from
The documents an auditor asks for, pre-filled from what you've already told us — a starting draft, not a blank page.
Evidence read for you
Upload a policy and ARIMA reads it, then tells you which controls its contents actually satisfy — and which it only looks like it does.
A room for your investors
Give an investor or consultant a read-only seat. They see readiness and progress; your raw answers stay yours, by construction.
Coverage
Every framework, and exactly how far we take it.
25 standards across seven domains. 9 have a human-verified crosswalk and feed your readiness score — those are marked scored below. The rest ARIMA scopes and cites without pretending to grade them. Each one links to the authority that publishes it.
Security & assurance
What buyers and auditors ask for first.
4 standardsSOC 2ScoredTrust Services Criteria (2017, revised points of focus 2022)AICPA · TSP Section 100ISO 27001ScoredInformation security management systems (Annex A) + 27002 guidanceISO/IEC · ISO/IEC 27001:2022HIPAAScoredHIPAA Security RuleU.S. Dept. of Health & Human Services · 45 CFR Part 160, Part 164 Subparts A & CPCI DSSCitedPayment Card Industry Data Security StandardPCI Security Standards Council · PCI DSS v4.0.1
Privacy & personal data
Triggered the moment you hold a user record.
3 standardsGDPRScoredGeneral Data Protection RegulationEuropean Parliament & Council · Regulation (EU) 2016/679CCPA / CPRAScoredCalifornia Consumer Privacy Act, as amended by the CPRAState of California · Cal. Civ. Code § 1798.100 et seq.FERPACitedFamily Educational Rights and Privacy ActU.S. Dept. of Education · 20 U.S.C. § 1232g; 34 CFR Part 99
Financial, tax & trade
Money movement, cross-border sales, sanctions.
5 standardsBSA / AMLScoredBank Secrecy Act / Anti-Money-LaunderingU.S. FinCEN · 31 U.S.C. § 5311 et seq.; 31 CFR Chapter XEU VATCitedEU VAT DirectiveEuropean Union · Directive 2006/112/ECSales-tax nexusCitedU.S. state sales-tax economic nexusU.S. states / SCOTUS · South Dakota v. Wayfair (2018)OFACCitedOFAC sanctions (SDN list & programs)U.S. Treasury OFAC · 31 CFR Chapter VEARCitedU.S. Export Administration RegulationsU.S. Commerce BIS · 15 CFR Parts 730–774
Corporate, people & IP
The diligence questions that stall a raise.
4 standardsCorporate & LegalScoredARIMA Corporate & Legal baseline (curated)ARIMA · internal baseline
Employment & HRScoredARIMA Employment & HR baseline (curated)ARIMA · internal baseline
TrademarksCitedU.S. trademark registration (Lanham Act)USPTO · 15 U.S.C. ch. 22SPDX licencesCitedSPDX License List (open-source licence identification)Linux Foundation / SPDX · SPDX License ListAI governance
New obligations, arriving on a deadline.
3 standardsPlatform & distribution
If you ship an app, these gate the release.
3 standardsSocial & sustainability
What enterprise procurement now asks for.
3 standardsModern SlaveryCitedUK Modern Slavery Act 2015UK Parliament · Modern Slavery Act 2015, s.54GHG ProtocolCitedGreenhouse Gas Protocol (Corporate Standard)WRI & WBCSD · Corporate Accounting & Reporting StandardCSRD / ESRSCitedEU Corporate Sustainability Reporting DirectiveEuropean Union · Directive (EU) 2022/2464 + ESRS
Names are cited, not endorsed. The standards above belong to their issuing bodies, and the marks beside them are ARIMA's own drawings — no issuer has reviewed, certified or endorsed this product. ARIMA measures audit readiness; certification only ever comes from a qualified auditor or the relevant authority.
Who it's for
One workspace, three seats.
The same assessment, seen from whichever side of the table you sit on.
Founders
You're being asked for SOC 2 by a customer who won't sign without it, and you have no idea what it costs you.
- Find out where you stand before you pay an auditor
- One questionnaire, every framework that applies
- Drafts and fixes, not a 200-page PDF
Investors
You want portfolio-wide risk without chasing twelve founders for a spreadsheet each quarter.
- Read-only seats across your portfolio
- Benchmarks gated at five companies minimum
- Progress over time, not a point-in-time claim
Consultants
You run readiness for a book of clients and re-do the same intake for every one of them.
- Every client in one portfolio view
- Shared workspaces with per-client access
- The crosswalk does the mapping work
Find out where you stand.
Five minutes, no credentials, no sales call. You'll leave with a readiness score, a ranked list of gaps, and the drafts to start closing them.