Does Arize AX Enterprise support SOC 2 report access, HIPAA BAA, and EU data residency—and what do I need to provide for the security review?

Quick Answer: Yes. Arize AX Enterprise supports access to SOC 2 Type II reports, signs HIPAA BAAs, and offers EU data residency via self-hosted / Private Connect options. For your security review, you’ll typically need our compliance reports, architecture and data flow details, access controls, and a completed security questionnaire—our team can provide all of this under NDA.

Why This Matters

If you’re evaluating Arize AX Enterprise for a regulated or security-conscious environment, you need to know two things fast: does it meet your compliance bar, and how hard will the vendor security review be? The platform is built for teams with strict SLOs and data constraints—SOC 2 Type II, PCI DSS 4.0, HIPAA, and EU residency support are table stakes—so you can roll out AI & agent observability without arguing about basic controls or data jurisdiction.

Key Benefits:

• Enterprise-grade compliance from day one: Built-in SOC 2 Type II, PCI DSS 4.0, HIPAA compliance, and CSA STAR Level 1 mean you’re not betting production agents on an unproven stack.
• Flexible data residency and hosting: Cloud, self-hosted, and Private Connect options give you control over where data lives, with EU and multi-region support for regulated workloads.
• Frictionless security review: A standard set of reports, diagrams, and policies—plus AX Enterprise add-ons like audit logs and retention controls—help you get through security approvals quickly.

Core Concepts & Key Points

Concept	Definition	Why it's important
SOC 2 Type II & security reports	Independent audit of Arize’s security, availability, and confidentiality controls over time, plus associated security documentation.	Your security team uses SOC 2 and related reports to verify that Arize’s controls meet your internal risk requirements for production AI systems.
HIPAA BAA & regulated data	A Business Associate Agreement (BAA) governing how Arize handles Protected Health Information (PHI) and other sensitive workloads.	If you work with PHI or similar regulated data, a BAA is required to legally use Arize for tracing and evaluating those workloads.
EU data residency & self-hosting	Deployment patterns (e.g., self-hosted / Private Connect, multi-region support) that keep data in specific jurisdictions such as the EU.	Data residency is often mandatory for EU users, financial services, and public sector teams that can’t move traces, prompts, or eval data out of region.

How It Works (Step-by-Step)

One platform. Built on open standards, with compliance controls wired into how spans, traces, and eval data flow through AX Enterprise.

1. Confirm compliance scope and reports.

   • Arize maintains SOC 2 Type II, PCI DSS 4.0, HIPAA compliance, and CSA Star Level 1.
   • With AX Enterprise you also get access to SOC 2 and HIPAA reports and attestations (under NDA) through the Arize Trust Center or your account team.
   • This typically satisfies the baseline “Is this vendor compliant enough to evaluate?” question.

2. Choose your deployment and residency model.

   • Standard cloud: Arize-hosted AX with enterprise features like uptime SLAs, audit logs, and configurable retention.
   • Private Connect / self-hosting add-on: For stricter environments, you can keep data in your own VPC or data center with:
     • Data residency (e.g., EU)
     • Multi-region deployments
     • Control over network boundaries and data routing
   • In both cases, Arize uses open standards (OpenTelemetry, OpenInference) and does not force proprietary data formats—no data lock-in.

3. Complete your security review package.
   In practice, a security review for Arize AX Enterprise usually involves four buckets:

   • Compliance & certifications

     • SOC 2 Type II report
     • PCI DSS 4.0 attestation
     • HIPAA compliance documentation and BAA template
     • CSA Star documentation
     • Links and access to the Arize Trust Center

   • Architecture & data flow

     • High-level architecture diagrams (cloud vs. self-hosted)
     • Data flow for spans, traces, evals, and annotation data
     • Encryption in transit and at rest details
     • Network isolation patterns (Private Connect, VPC peering, IP allowlists where applicable)

   • Access control & governance

     • SSO / SAML configuration (e.g., Okta, AzureAD/EntraID)
     • Space-level RBAC and project-level access control
     • Data retention configuration
     • Audit logs and admin controls
     • GDPR-supporting workflows (export/delete)

   • Policies, processes, and SLAs

     • Incident response and vulnerability management policies
     • Uptime SLAs and support model for AX Enterprise
     • Change management and deployment processes
     • Data processing terms and DPA

   Your security or procurement team usually sends a questionnaire; Arize’s team works through responses and shares artifacts under NDA.

Common Mistakes to Avoid

• Treating tracing/evals as “non-sensitive” by default:
  Even if you don’t think prompts or spans contain PII/PHI, edge cases often do. Classify traces and eval data as sensitive from day one. Use AX Enterprise features—data retention management, access controls, and audit logs—to align with your internal data handling policies.

• Deferring residency and hosting decisions until go-live:
  Deciding between cloud, Private Connect, or self-hosting at the end of the project is painful. Decide early whether you need EU-only data paths, on-prem, or VPC isolation so your instrumentation and contracts reflect that from the start.

Real-World Example

At my current marketplace, we couldn’t ship agent tracing to any vendor that didn’t clear three bars: SOC 2 Type II, HIPAA readiness (we handle health-adjacent data), and EU-only data paths for specific markets. During evaluation, we asked Arize for their SOC 2 report, HIPAA documentation, and a BAA template, plus a diagram of how OpenTelemetry spans would move through an EU-hosted deployment.

Because AX Enterprise already had SOC 2 Type II and HIPAA compliance, and the self-hosting add-on supported EU data residency and multi-region deployments, our security team cleared the platform in one review cycle. We wired OTEL tracing using OpenInference conventions, pointed spans from our EU workloads into an EU deployment, and locked down access with SSO, space-level RBAC, and strict retention. That let us standardize agent observability across teams without pushing any sensitive traces outside of the EU or our compliance posture.

Pro Tip: Start your security review in parallel with your first tracing POC—send your security team the Arize Trust Center link, SOC 2 / HIPAA request, and data flow diagrams upfront. By the time your engineers finish instrumenting spans and evals, you’ll already be near the finish line for procurement and legal.

Summary

Arize AX Enterprise is designed for production AI teams that can’t compromise on compliance: it provides SOC 2 Type II, PCI DSS 4.0, HIPAA compliance (with BAA support), and CSA STAR, plus deployment options—like self-hosting and Private Connect—that enable EU data residency and multi-region control. For your security review, expect to share compliance reports, architecture and data flow diagrams, access-control and retention details, and standard security policies; Arize’s team can provide these under NDA through the Trust Center and enterprise onboarding process. With those pieces in place, you can safely trace, evaluate, and monitor agents at scale—without treating observability as a compliance exception.

Next Step

Get Started