Compliance

Overview

At Ares, we are committed to maintaining the highest standards of security and compliance. We understand that protecting your data is essential to earning and maintaining your trust.

SOC 2

Ares is SOC 2 Type II compliant. Our controls for protecting customer data have been independently audited against the security, availability, and confidentiality standards set by the American Institute of CPAs (AICPA), and are continuously monitored through Oneleet, our compliance and security platform. Review our security and compliance program in our Trust Center (opens in new tab).

GDPR

Ares is GDPR compliant. Our handling of personal data for users in the European Economic Area has been verified against the General Data Protection Regulation and is continuously monitored through Oneleet, our compliance and security platform. This includes:

• •Lawful basis for processing personal data
• •Data subject rights including access, rectification, and erasure
• •Data processing agreements with sub-processors
• •Appropriate safeguards for international data transfers

CASA

Ares has achieved Tier 3 certification under the Cloud Application Security Assessment (CASA), a Google-led program administered by the App Defense Alliance that evaluates third-party applications accessing Google user data. This certification verifies that our application meets rigorous security standards for data handling, authentication, and vulnerability management.

Data Security

We implement comprehensive security measures to protect your data:

• •Encryption of data in transit and at rest
• •Regular security assessments and penetration testing
• •Access controls and authentication mechanisms
• •Incident response and disaster recovery procedures
• •Employee security training and awareness programs

Sub-processors

We carefully vet and monitor all third-party sub-processors that handle customer data. Our sub-processors are contractually obligated to maintain appropriate security measures and comply with applicable data protection laws.

Data Processing Agreement

Enterprise customers can request a Data Processing Agreement (DPA) that outlines our obligations as a data processor, including security measures, sub-processor management, and data subject rights assistance.