Arphie

Genuine spread across classes rather than depth in one, as the published directory shows. Arphie reads from document repositories (Google Drive, SharePoint, Dropbox, Box and Egnyte), wiki and knowledge surfaces (Confluence and Notion), sales enablement platforms (Seismic and Highspot), support content (Front help pages) and arbitrary web pages, including product documentation and marketing pages.

For compliance and GRC it connects to Vanta to pull the customer's current compliance evidence and control materials, which is a different class from content and directly relevant to the security questionnaire use case. In the CRM, Salesforce acts rather than ingests, letting a user create a new Arphie project from inside an opportunity. In chat, Slack carries notifications and a quick-ask agent. Arphie MCP adds connection to external AI tools. The directory carries fifteen connectors across seven classes. Most connectors are read-side ingestion into the content library, and only Salesforce and Slack carry an action back out, which shapes the product.

Sourcearphie.ai/integrationsread 2026-09-04

Fixed product pipelines, one per document type. Work runs from ingesting a questionnaire in whatever form it arrives, including Excel files carrying macros, through question extraction, retrieval across the connected live sources, first-draft generation with sources and confidence attached, collaboration and deadline tracking, approval and sign-off, and export in the required format.

Arphie ships that as distinct workflows for RFPs, RFQs, security questionnaires and DDQs, with the security route specialized for SIG, CAIQ and custom assessments, and a separate maintenance chain proposes duplicate merges, flags stale answers and suggests readability fixes. Those are Arphie's own sequences: no flow the buyer designs or changes, no branching or conditions the buyer configures, no coordinated set of agents handing work to one another and no runtime or API over the flow is documented.

Sourcearphie.ai/platform and arphie.ai/security-teamsread 2026-10-01

The core mechanism, and the architectural choice is the evidence. Rather than requiring answers to be re-keyed into a maintained question and answer library, Arphie reads directly from the customer's live sources: document repositories, wikis, sales enablement platforms, help content, arbitrary product and marketing web pages, and the customer's Vanta instance for current compliance evidence and control materials, with selective inclusion over what is connected.

When a source document changes the agents work from the new version, and stale content is flagged proactively rather than discovered at audit. Grounding quality is exposed rather than asserted: every generated answer surfaces the exact sources used and a confidence level. The material is the buyer's own and stays where the buyer maintains it. The approved-answer library that builds up across engagements is part of that grounding too; it is the customer's content, not agent memory.

Sourcearphie.ai/integrations and arphie.ai/platformread 2026-09-04

Review and approval run on Arphie's own surface. Agents produce first drafts only and never final answers, every draft carries the exact sources used and a confidence level so review is verification rather than rewriting, and answer approval and sign-off are explicit workflow steps rather than an informal convention, with deadline tracking and collaboration around them. The gate is Arphie's own: nothing leaves for a customer without a person moving it through those steps inside the platform.

Role-based read-only and read-and-write permissions are an access model, separate from this review gate. The guardrails are procedural rather than policy based. No content policy check, blocked-topic rule, confidence threshold that automatically withholds an answer, or escalation rule tied to a score is documented, so the confidence level informs a human rather than gating the agent.

Sourcearphie.ai/platform and arphie.ai/securityread 2026-09-04

Compliance and access controls are both documented on Arphie's own security page, and the access controls are specific. Identity integration is single sign-on through SAML 2.0 plus Google authentication, with Okta, OneLogin, Microsoft Azure and ADFS named as supported providers, and the access model is stated in the FAQ: customers define different user roles with different permissions inside the platform, read-only or read-and-write.

That is a buyer able to see and set who inside their organization can make the agents act.

The compliance program behind it covers SOC 2 Type 2 evaluated annually by an independent firm, annual third-party penetration testing, TLS 1.2 in transit and AES256 at rest, data segregation with per-customer record identifiers, hosting on SOC 2 compliant infrastructure providers, annual employee security training, a documented information security program and a published responsible disclosure policy.

Zero data retention agreements with OpenAI and Anthropic act as a retention control. The audit firm is not named, no penetration test report or SOC 2 report is published or requestable through a trust center, and there is no trust portal at all, only this page. Single sign-on is limited to Enterprise customers.

Sourcearphie.ai/securityread 2026-09-04

Agent-level reasoning exposed to the customer. Arphie's platform page offers full auditing capability to understand why and how its agents answered questions step by step, and the security questionnaire page repeats it for each control question and frames the purpose as defensibility for internal review and customer follow-ups.

Every generated answer carries the exact sources used and a confidence level, so a reviewer sees both what the answer rests on and how sure the system is. That reconstructs the agent's reasoning rather than merely logging that an answer was produced. Auditability is per answer rather than platform-wide, and no admin activity log, configuration change trail, export of the reasoning record or retention setting is documented.

Sourcearphie.ai/platform and arphie.ai/security-teamsread 2026-10-01

Approved answers accumulate in a content library, which is a knowledge store rather than agent memory. Answers that clear review persist and are reused on later questionnaires, so each completed RFP or security questionnaire leaves the library better stocked. That library is the customer's content, read as a source alongside the live connected repositories, and a content store is not memory. No memory construct the agents write and read back as their own state, no per user or per engagement recall and no retention or forgetting control at the agent level is documented.

Sourcearphie.ai/platformread 2026-10-01

Multi-tenant cloud with no location or topology control offered. The security page states that customer data is hosted on cloud infrastructure providers that are themselves SOC 2 compliant, with web servers and databases load-balanced across multiple availability zones, which is a reliability arrangement rather than a residency option, and it is the closest Arphie comes to describing where data sits.

No region selection, EU or other in-region option, private VPC, single-tenant tier, on-premises route or customer-managed key is published. Isolation is logical rather than physical: customer data is segregated through coding standards, database design and a unique per-customer record identifier. The security page is detailed, which makes its silence on location telling. Arphie sells into security and compliance teams, and residency is a common requirement in the questionnaires its own product answers.

Sourcearphie.ai/securityread 2026-09-04

Specialized paths that ship configured, with nothing to browse and adopt. Arphie provides distinct workflows for RFPs, RFQs, security questionnaires and DDQs rather than one generic path, the security route handles named questionnaire standards including SIG and CAIQ, and behavior is shaped by standing instructions set at organization and questionnaire level.

That is the product arriving configured rather than a catalog. No template gallery, no library of prebuilt agents or plays a customer browses and selects from, and no marketplace appears anywhere on the property. A user does pick which document type they are working on, but there is nothing to browse.

Sourcearphie.ai/platform and arphie.ai/security-teamsread 2026-09-04

Several ways in, all of them started by a person, and nothing that fires on its own. Work enters by uploading a questionnaire or RFP in the form it arrived, including Excel with macros; by asking Arphie's quick-ask agent inside Slack; and by creating a new Arphie project from within a Salesforce opportunity. Output leaves as exported documents in the customer's required format, with Slack notifications on progress.

Every route is a person starting a piece of work. There is no schedule, recurring run, event trigger, inbound email or webhook, and no watcher that opens a project when a questionnaire lands. The closest thing to an event is stale-content flagging when a connected source changes, which raises a suggestion rather than starting work.

Sourcearphie.ai/integrations and arphie.ai/platformread 2026-09-04

Two providers named, chosen by Arphie rather than the customer. Arphie's security page states custom enterprise agreements with leading AI model providers, naming OpenAI and Anthropic, which is disclosure of what powers the product rather than an inference. More than one provider runs internally, with no selection exposed to the buyer.

No model list beyond those two names is published, and there is no routing policy, no statement of which model handles which task, no per-agent or per-workspace selection and no bring-your-own-key option. The zero data retention agreement is a retention control rather than a model choice.

Sourcearphie.ai/securityread 2026-09-04

An MCP server exists, and it reads rather than acts. Arphie publishes Arphie MCP as its own integration, built by Arphie, connecting Arphie data to AI tools including Claude, ChatGPT and Cursor, so the platform's content is reachable from a customer's own assistant.

The server's role is narrow: Arphie categorizes it on its own page as a Data Source, and nothing documents tools that act back on the platform, so an assistant can draw on Arphie content but cannot create a project, draft an answer or move one through approval. There is also no public REST API, SDK or client library, endpoint reference or developer documentation site, and no published tool list for the MCP itself. The source connectors are Arphie reaching into other systems, not a way for others to build on Arphie.

Sourcearphie.ai/integrations/arphie-mcp and arphie.ai/integrationsread 2026-09-04

A quality mechanism the customer holds, with no comparison behind it. Every generated answer carries a confidence level, which is a readable assessment of the agent's own output against a criterion and routes reviewer attention to the weakest answers rather than reporting after the fact. A second mechanism runs on the content library, with agents proposing duplicate merges, flagging answers gone stale against changed sources and suggesting readability improvements.

Both are mechanisms rather than dashboards, and both are the customer's rather than internal. What is missing is comparison. There is no controlled test of one configuration against another, no scored evaluation set, no benchmark, no regression check when standing instructions or connected sources change, and no sandbox or dry run before answers reach a reviewer.

Sourcearphie.ai/platform and arphie.ai/featuresread 2026-09-04

Everything the agents touch arrives through an authenticated connector. Source material is ingested from Google Drive, SharePoint, Dropbox, Box, Egnyte, Notion, Confluence, Front, Seismic, Highspot, Vanta and specified web pages, and output leaves as an exported document; nothing describes an agent driving an interface it does not control. No headless browsing, virtual desktop, screen or click automation is published. Online portals are the one open question.

Arphie's security questionnaire page says it handles questionnaires whether they arrive as an Excel file with macros or as an online portal, and portals are exactly the surface with no programmatic interface. Nothing describes the agent logging into or filling a customer portal, so the portal reads as a format the product accepts rather than software it operates.

Sourcearphie.ai/integrations and arphie.ai/security-teamsread 2026-09-04