# ArvexLab

> AI-native compliance platform for NIS2 and DORA. Purpose-built for EU organizations to manage third-party risk, vendor assessments, and regulatory compliance.

## Platform

- [Homepage](https://arvexlab.com): AI-native compliance for the new regulatory era
- [About](https://arvexlab.com/about): Company mission, team, and approach
- [Contact](https://arvexlab.com/contact): Request a demo or get in touch

## Free Tools

- [NIS2 Self-Assessment](https://arvexlab.com/nis2-assessment): Free 41-question compliance check across all 10 Art. 21 security measures. Determines if NIS2 applies and identifies gaps. No signup required.
- [Framework Overlap Calculator](https://arvexlab.com/framework-overlap): See how existing certifications (ISO 27001, SOC 2, BSI C5) already satisfy NIS2 requirements. 547+ cross-framework mappings.

## Compliance Frameworks

ArvexLab covers NIS2 Directive (primary), DORA (Digital Operational Resilience Act), GDPR, and ISO 27001. The platform automates vendor security questionnaires with AI pre-fill from uploaded documents (SOC 2 reports, ISO certificates, security policies).

## Key Capabilities

- AI document intelligence: Upload a SOC 2 or ISO 27001 PDF, get controls extracted with confidence scores in under a minute
- Vendor risk scoring: Configurable 5-component weights, auto-recalculation on every evidence change
- NIS2 compliance hub: 37 requirements across Art. 20, 21, 23 with gap analysis and maturity scoring
- Questionnaire auto-fill: AI pre-fills 80%+ of vendor questionnaire answers from uploaded certifications
- Evidence pack export: One-click audit-ready ZIP with structured evidence per NIS2 category
- CSIRT notification: Art. 23 incident reporting with 24h/72h/1-month workflow and PDF export

## Legal

- [Privacy Policy](https://arvexlab.com/privacy)
- [Terms of Service](https://arvexlab.com/terms)
- [Cookie Policy](https://arvexlab.com/gdpr)
- [Sub-Processors](https://arvexlab.com/subprocessors)
- [Impressum](https://arvexlab.com/impressum)

## Technical

- EU data residency (Frankfurt, Germany)
- End-to-end encryption (TLS 1.3 in transit, AES-256 at rest)
- Row-level security via Supabase
- AI models: Google Gemini 2.0 Flash (document analysis), Claude Haiku 4.5 (SOC 2 parsing)