// the platform

One platform. Complete governance. Day one.

ARX wraps your team's existing AI agents with the compliance and governance layer they were missing — without changing how your engineers build.

// how arx works

The governance layer sits between your agents and everything they touch.

Every API call your agent makes passes through the ARX policy engine before it reaches the external system. Not logged after the fact — evaluated before it runs.

CUSTOMER AGENT RUNTIME Your existing Docker containers, Python scripts, or framework-based agents. Unchanged. Unmodified.
EVERY CALL INTERCEPTED
ARX GOVERNANCE LAYER
Policy Engine Audit Logger Human Gates
Intercepts · Evaluates · Logs · Routes · Enforces
CONTROLLED EXECUTION
YOUR SECURITY TOOLS CrowdStrike · Splunk · Wiz · Palo Alto · ServiceNow · Okta · +4 more
// capabilities

Everything in the platform. Explained.

AGENT REGISTRY
See every agent. From the moment it deploys.

Most teams have no idea how many agents are running, who owns them, or what systems they touch. The agent registry gives you a single, always-current inventory of every agent in your environment.

Each entry tracks the agent's owner, status, connected systems, last execution time, and policy compliance state. If an agent is deployed without being registered, the platform flags it immediately.

AGENT NAME         OWNER       STATUS    SYSTEMS         LAST RUN
triage-bot         m.chen       active   CS, Splunk       2m ago
vuln-correlator    j.park       active   Wiz, Jira        14m ago
alert-enricher     s.kumar      paused   Sentinel, Okta   2h ago
14:32:07   triage-bot   detections:list   CrowdStrike   LOW   PERMIT 🔒
14:31:44   triage-bot   incident:update   Splunk   MED   PERMIT 🔒
14:30:12   vuln-correlator   findings:read   Wiz   LOW   PERMIT 🔒
14:28:55   alert-enricher   users:lookup   Okta   MED   PERMIT 🔒
14:27:03   triage-bot   hosts:contain   CrowdStrike   HIGH   ESCALATE 🔒
IMMUTABLE AUDIT TRAIL
Every action. Logged. Forever. Unalterable.

Every API call, every policy evaluation, every approval decision — captured in a tamper-proof, append-only audit log. You cannot edit it. You cannot delete it. Neither can we.

When a regulator or auditor asks what your agent did on a specific date, you hand them the log. Timestamped. Cryptographically chained. Exportable to SIEM, S3, or compliance platforms.

INV-001 · INV-002 — Patent Pending
POLICY GUARDRAILS
Define what each agent is allowed to do. The platform enforces it.

Policies are rules that bind an agent to specific operations on specific systems. If an agent tries something outside its declared scope, the platform blocks it before the call leaves your environment.

Rule types: PERMIT, DENY, ESCALATE.
Scope: per-agent, per-connector, per-operation.
Conditions: time-of-day, risk score, data classification.

INV-002 · INV-005 — Patent Pending
triage-bot · detections:read PERMIT
triage-bot · hosts:write ESCALATE
vuln-scanner · *:delete DENY
⚠️ Approval Required
Agent:triage-bot
Connector:CrowdStrike
Operation:contain_host
Risk Score:84/100
Expires in 58 minutes
HUMAN APPROVAL GATES
High-risk actions pause. You decide. Then it continues.

When an agent triggers a high-risk operation — host containment, user suspension, firewall changes — the platform pauses execution and routes an approval request to Slack, Teams, or email.

The designated approver reviews the context, approves or denies, and the agent resumes or halts. Every decision is logged. If no one responds, the action expires safely.

INV-002 — Patent Pending
COMPLIANCE PACKAGE GENERATOR
One click. Everything procurement needs.

The compliance package generator produces a complete, audit-ready document set from your agent's actual runtime behavior and policy configuration. No manual questionnaires. No six-month review cycles.

Includes:

• Vendor Security Questionnaire (CAIQ v4)
• Data Flow Diagram (auto-generated)
• Sub-Processor List
• SOC 2 Control Mapping

INV-001 · INV-004 — Patent Pending
ARX COMPLIANCE PACKAGE
✓ Vendor Security Questionnaire (CAIQ v4)
✓ Data Flow Diagram
✓ Sub-Processor List
✓ SOC 2 Control Mapping
Generated in 4 minutes
Normal behavior Anomaly Suspended
DRIFT DETECTED
Agent accessed Okta outside declared scope
Status: Suspended
BEHAVIORAL DRIFT DETECTION
If an agent starts acting outside its declared scope — ARX catches it first.

ARX continuously monitors each agent's runtime behavior against its declared policy scope. If an agent begins accessing systems, operations, or data outside its baseline, the platform flags the drift and can automatically suspend execution.

Drift events are logged, alerted, and available for forensic review. You see what changed, when it changed, and what the agent attempted.

INV-003 — Patent Pending
UNIVERSAL SECRETS VAULT
Works with the vault you already have.

ARX does not store your secrets. It integrates with the secrets manager you already run — cloud-native or third-party — and brokers access to your agents at runtime. Credentials are never written to disk, never logged, and never exposed to agent code.

One integration point. Every vault supported. Rotations, lease management, and access auditing handled automatically.

INV-005 — Patent Pending
CLOUD-NATIVE
AWS Secrets Manager
Native AWS integration
Azure Key Vault
Microsoft cloud secrets
GCP Secret Manager
Google Cloud secrets
HashiCorp Vault / HCP
Self-hosted or managed
ENTERPRISE & SAAS
CyberArk Conjur
Enterprise PAM integration
Akeyless
SaaS secrets platform
Infisical
Open-source secrets management
Doppler
Developer-first secrets
EDR
CrowdStrike
HIGH RISK
SIEM
Splunk
READ-OPTIMIZED
SOAR
Palo Alto XSIAM
HIGH RISK
CNAPP
Wiz
READ-OPTIMIZED
ITSM
ServiceNow
MEDIUM
IDENTITY
Okta
HIGH RISK
SIEM
Sentinel
READ-OPTIMIZED
PROJECT
Jira
MEDIUM
COMMS
Slack
HITL CHANNEL
INCIDENTS
PagerDuty
MEDIUM
SECURITY CONNECTOR LIBRARY
Ten connectors. Pre-built. Authenticated. Policy-enforced. Day one.

Each connector is a fully authenticated, policy-enforced integration with a major security platform. Not a generic API wrapper — a purpose-built interface that understands the platform's data model, rate limits, and risk surface.

Every operation through every connector passes through the governance layer. Read operations are logged. Write operations can require approval. Delete operations can be blocked entirely.

// infrastructure

Deploy on the cloud you already trust.

AWS DEPLOYMENT
ARX on Amazon Web Services
Single-tenant deployment into your AWS account. Your data never leaves your VPC. ARX manages the infrastructure; you own the environment.
· EKS-based agent runtime
· RDS PostgreSQL audit store
· S3 compliance artifact storage
· KMS envelope encryption
· PrivateLink connectivity
AZURE DEPLOYMENT
ARX on Microsoft Azure
Single-tenant deployment into your Azure subscription. Full integration with Entra ID, Sentinel, and Azure-native security tooling.
· AKS-based agent runtime
· Azure SQL audit store
· Blob Storage compliance artifacts
· Key Vault envelope encryption
· Private Endpoint connectivity
GCP deployment arriving Q3 2026 · contact us for early access
// mcp gateway

Any tool via MCP. Still governed.

The Model Context Protocol gateway lets your agents reach any MCP-compatible tool through the same governance layer that protects your native connectors. Same policies. Same audit trail. Same approval gates.

Tier 1 Native Connectors
Ten purpose-built connectors with deep platform integration, schema-aware policy enforcement, and optimized rate handling. These are the connectors most security teams need on day one.
MCP Gateway
For everything else. Point the gateway at any MCP-compatible tool server and ARX applies the same governance layer automatically — policy evaluation, audit logging, and human approval gates. No custom integration work.
// compliance posture

SOC 2 certified infrastructure. Day one.

SOC 2 TYPE II
Certified infrastructure
256-BIT AES
Encryption at rest
TLS 1.3
Encryption in transit
SINGLE-TENANT
Isolated deployments
Your agent's compliance posture is only as strong as the platform it runs on. ARX is built on SOC 2 Type II certified infrastructure from day one — not as a roadmap item. Every audit log is cryptographically chained. Every secret is envelope-encrypted. Every deployment is single-tenant and isolated.
EARLY ACCESS
Patent Pending Technology · SOC 2 Compliant Infrastructure
Be first when we launch.
We are onboarding a limited number of pilot teams. No cost during the pilot period.
Your team already built the agent. Now make it enterprise-ready.
Schedule 30 Minutes
Arx Inc. · Dallas, TX · legal@arxsec.io