Compliance
You handle PHI, cardholder data or an auditor’s control list, and you need to know before you buy whether a standard hosting plan can carry it. HIPAA, PCI DSS, SOC 2, CJIS, CMMC: we build the environment your framework asks for. Each one is its own engineering project, scoped and quoted on its own. Compliance hosting is not included in standard hosting plans, and we’ll never pretend otherwise.
Individually scoped & quoted BAA executed in-engagement DPA already in every agreement SOC 1 & SOC 2 Type 2 certified datacenter
Managed hosting and compliance hosting are different things, and knowing which one you need is the first step of any compliance program.
Every Web Hosting, VPS & VDS plan
Fully managed, with security as the default: malware scanning, a web application firewall, daily backups, monitoring, and patch management.
Custom-engineered · individually scoped & quoted
A purpose-built environment on managed VPS or Virtual Dedicated Server infrastructure, engineered around your framework’s control requirements from the start. This is enterprise work: dedicated hardware, documented controls, audit-ready logging.
To be explicit: hosting on Blue Arctic does not by itself make your workload compliant with any framework. Standard plans are not HIPAA, PCI DSS, SOC 2, CJIS, or CMMC compliant environments. If you handle regulated data, start with a scoped compliance engagement, not a shared hosting checkout.
We build each environment around what your framework requires, and we quote it on its own. Typical scope includes:
When your framework says your environment cannot share space with anyone else’s, it does not. So we build one that is yours alone.
Role-based access, hardened configurations, private network segments, and firewall policy built to your framework’s control requirements.
When your auditor asks who did what, and when, the records are already there. Event logging, access logs, and audit trails configured to your retention and evidence requirements.
Backup and disaster recovery designed to your framework’s requirements. We sign a Business Associate Agreement as part of the engagement, with a defined shared responsibility model. A Data Processing Addendum needs no engagement: it already applies to every account and is published in full.
No two engagements are identical, but every one follows the same sequence, and it starts with a conversation rather than a checkout page.
HIPAA, PCI DSS, SOC 2, CJIS, CMMC, GDPR, or something else. We talk through what you run, what data it touches, and what your auditors will ask for.
You get a direct answer on what the environment involves, where the responsibility boundary sits, and what it costs.
We build it on managed VPS or Virtual Dedicated Server infrastructure. Isolation, access controls, logging and disaster recovery are all designed to your controls. We sign a BAA with the engagement. Your DPA is already in force.
Our engineers run the infrastructure layer while your team runs the application, data and policy side. The section below sets out that boundary.
Healthcare. We host PHI workloads, health record platforms and the apps patients log in to, on an environment built to HIPAA controls.
Government. We host state and local agency systems, public-facing portals, and internal tools that have to pass a security audit.
Financial services. We host PCI DSS-scoped environments, fintech platforms, and apps that handle cardholder or other sensitive financial data.
SaaS and applications. We host SaaS and B2B products whose own customers ask to see how the hosting is secured.
Compliance is never one party’s responsibility, and this is where the line falls.
Infrastructure, physical environment, and network controls
Application logic, data handling, and user access policies
No. Every standard plan is fully managed and includes strong operational security. But managed hosting and compliance hosting are different things. Standard plans are not HIPAA, PCI DSS, SOC 2, CJIS, or CMMC compliant environments. We build compliance environments as custom engagements, and we quote each one on its own.
No. The Tampa, FL datacenter holds SOC 1 and SOC 2 Type 2 certification covering its physical and operational controls. That certification belongs to the datacenter. It is not a Blue Arctic product certification.
We scope and quote every compliance environment on its own. There is no price list, because two frameworks rarely ask for the same controls and two auditors rarely ask for the same evidence. Tell us your framework and your workload, and we’ll give you a direct answer on what the engagement involves and what it costs.
These are two different documents. A Data Processing Addendum already applies to every Blue Arctic account. It is part of your Master Service Agreement and it includes the Standard Contractual Clauses. You can read it now without asking us for anything. A Business Associate Agreement is different. We sign BAAs as part of a compliance engagement, alongside a documented shared responsibility model.
Just need strong everyday security? That’s standard on every plan, no engagement required.
