Arborgrc· TRUSTA9 ADVISORY FZ-LLC · TRUST CENTER
Security, plainly stated.
A9 Advisory operates ArborGRC under continuous controls monitoring. Every certification is refreshed quarterly. Every document is the live, current version.
Live uptime
99.98%
Last updated
17 Apr 2026
Active subprocessors
14
Data residency
UAE · EU · US
Proofs, not promises.
UAE PDPL
Readiness AssessedNESA T3
In ProgressWhat we measure.
Uptime · 90 days
99.98%
▲ 0.02
MFA adoption
100%
Mean patch SLA
4.3d
▼ 0.5d
Active pentest findings
0 critical
Subprocessors
14
Data residency options
UAE · EU · US
Everything you'd ask in a questionnaire — already on the shelf.
UAE-IA Audit Letter — 2025
v1.0 · 2025-11-10
PublicSOC 2 Type I Readiness Report
v2026-Q2 · 2026-04-14
Auth-gatedInformation Security Policy
v3.2 · 2026-01-15
PublicExternal Pentest — Redacted Summary
v2026-Q1 · 2026-02-25
Auth-gatedSoftware Bill of Materials (SBOM)
v2026.04 · 2026-04-01
Auth-gatedBusiness Continuity & DR Summary
v1.6 · 2025-11-01
PublicOur supply chain.
| Vendor | Purpose | Region | Attestations |
|---|---|---|---|
| Microsoft Azure | Cloud hosting | UAE / EU | SOC 2ISO 27001 |
| Cloudflare | CDN + WAF | Global | SOC 2 |
| Datadog | Observability | US / EU | SOC 2 |
| CrowdStrike | Endpoint protection | US | ISO 27001 |
| Okta | Identity (legacy) | US / EU | SOC 2 |
| GitHub | Source control | US | SOC 2 |
| Atlassian | Project tracking | US / EU | SOC 2 |
| Slack | Internal comms | US | SOC 2 |
| Zendesk | Support | US | SOC 2 |
| Stripe | Billing | US / EU | SOC 2PCI-DSS |
Common questions, pre-answered.
Do you encrypt data at rest?
Yes. All data is encrypted using AES-256 with customer-managed keys in Azure Key Vault.
Where is customer data stored?
Primary: UAE North. DR: UAE Central. EU/US regions available on request.
What is your SLA?
99.9% monthly uptime target. 99.98% delivered trailing 90 days.
Do you support SSO / SAML / SCIM?
Yes. Microsoft Entra ID and Okta are supported natively. SCIM provisioning for all plans.
How often do you pentest?
Annually by an accredited third party. Findings summarised in the pentest report available above.
Do you have an incident response plan?
Yes. See the Incident Response Policy above. Critical incidents are disclosed to affected customers within 72 hours.
See what Arbor can do for you.
Join mid-market teams across the UAE and EU who replaced spreadsheets with a platform built for continuous compliance.