generated: '2026-07-18'
method: searched
source: https://docs.archil.com/details/security
standards:
- id: oauth2
  conforms: false
  evidence: Control Plane uses account-scoped API keys (Authorization header), not OAuth2.
- id: openid-connect
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a custom {success:false, error:string} envelope, not application/problem+json.
- id: s3-api-compatibility
  conforms: true
  evidence: Archil exposes an S3-compatible HTTP API (list/get/put/delete objects) usable by standard S3 clients.
- id: posix-filesystem
  conforms: true
  evidence: Disks present as full POSIX-compatible directory trees (docs/details/support).
- id: cursor-pagination
  conforms: true
  evidence: listDisks uses a `cursor` query parameter for pagination.
- id: soc2-type-ii
  conforms: true
  evidence: Ongoing SOC 2 Type II audits covering security, availability, and confidentiality.
- id: hipaa
  conforms: true
  evidence: Supports HIPAA workloads; BAAs available to Enterprise customers.
- id: gdpr
  conforms: true
  evidence: Stated GDPR compliant (docs/details/security).
- id: ccpa
  conforms: true
  evidence: Stated CCPA compliant (docs/details/security).
- id: iso-27001
  conforms: false
  evidence: ISO 27001 is held by the underlying cloud infrastructure, not asserted as Archil's own certification.
- id: pci-dss
  conforms: false
- id: tls-1.3
  conforms: true
  evidence: Client-to-service connections use TLS 1.3; unencrypted connections rejected.