Changelog

The SCIM 2.0 API now exposes a ServiceProviderConfig endpoint at /.well-known/scim/ServiceProviderConfig. The endpoint documents supported SCIM features — bulk operations, filtering, etags, and pagination — in machine-readable form. Identity providers and SCIM clients can discover provisioning capabilities automatically without manual configuration. The endpoint is authenticated and returns RFC 7643-compliant JSON.

An internal software bill of materials audit has been completed across all production dependencies. The audit verified license compatibility (all dependencies permissively licensed), identified and resolved two transitive dependency version pins, and produced a CycloneDX SBOM artifact for enterprise customers who require supply chain attestation. The SBOM is available to Enterprise customers on request via your account team.

The Arbitex terms of service, privacy policy, and data processing addendum have been updated to reflect current product scope, data handling practices, and enterprise procurement requirements. Changes include: clarified data residency language for Hybrid Outpost customers, updated subprocessor list, revised retention policy for audit log data, and added DPA annex covering cross-border transfer mechanisms under GDPR. Updated documents are live at arbitex.ai/legal.

The sales engineering reference deck has been updated with 2026 competitive positioning across all major comparison categories: AI gateways, enterprise DLP, cloud security, and browser/proxy-based solutions. New battle cards cover the prompt injection defense category and three SSE/CASB competitors. The deck includes updated capability matrices, objection-handling guides, and technical qualification questions for regulated-industry conversations.

The get-started onboarding guide at arbitex.ai/get-started has been rewritten as a developer-first integration path. The three-step flow — point your SDK at the Arbitex endpoint, send a request, see it in the audit log — is now illustrated with runnable code examples in curl, Python httpx, and Node fetch. The guide links directly to the API reference and covers the first-request experience from zero to governed in under five minutes.

The account security monitor now captures authentication events — logins, MFA completions, session initiations, and failed authentication attempts — directly in the tamper-proof audit log. Auth events follow the same OCSF event schema as AI transaction records, enabling unified correlation across user activity and AI request patterns. Auth event records are included in compliance evidence pack exports for SOX, GLBA, FedRAMP, and FISMA frameworks.

A new user security page is now available in the Arbitex admin portal. The page surfaces a security posture summary for each registered user: MFA enrollment status, active session count, recent authentication events, and any anomalous access flags from the account security monitor. Administrators can review security posture across all users from a single view and drill into individual user timelines without leaving the portal.

The admin portal now includes an active sessions panel that lists all live user and service account sessions across the organization: session start time, IP address, user agent, and last activity. Administrators can revoke individual sessions immediately from the panel — useful for incident response, offboarding workflows, and routine access hygiene. Session revocation events are recorded in the audit log with the acting administrator identity.

A new engineering blog post covers the entity recognition architecture at the core of the Arbitex DLP pipeline: ML recognizers with a rule-enhanced bridge for structured PII detection and an ML-driven model for contextual entity recognition. The post covers the failure modes of regex-only DLP, confidence scoring with configurable thresholds, and the structure of an entity detection audit record. Audience: security architects and compliance engineers evaluating enterprise AI DLP.

Several competitor comparison pages have been promoted from noindex to fully indexed status following content completeness review. Pages now indexed include the Arbitex vs. Prompt Security comparison and updated social metadata for the Arbitex vs. Portkey and Arbitex vs. LiteLLM pages. All comparison pages are available in the site index and will be included in search engine discovery.

The government industry reference page at arbitex.ai/industries/government covers AI governance requirements for federal agencies and public sector organizations. The page documents CUI detection across NIST SP 800-171 category markings, FedRAMP-aligned data sovereignty through Hybrid Outpost, NIST 800-53 Rev. 5 control mapping, air-gap deployment for classified and IL4/IL5 environments, and tamper-proof audit evidence for FISMA assessment packages.

The Arbitex DLP pipeline now includes a dedicated Employer Identification Number (EIN) detector. The detector identifies nine-digit EINs across structured and unstructured content, covering all common formatting variations used in payroll records, tax documents, vendor contracts, and financial reporting workflows. EIN detection integrates with active compliance bundles — GLBA, SOX, and PCI-DSS — and produces a structured audit log entry for every detection event.

The healthcare DLP bundle now detects PHI embedded in structured clinical document formats in addition to free-text content. New coverage includes Clinical Document Architecture (CDA) document identifiers, ICD-10 diagnosis code co-occurrence patterns, lab result value structures, and radiology report markers. The expansion improves detection accuracy for EHR integration workflows where PHI is contained in structured documents rather than conversational prompts. All 18 HIPAA-defined identifier categories remain covered across all detection contexts.

The government industry reference page at arbitex.ai/industries/government is now available. The page covers AI governance requirements for federal agencies and public sector organizations: CUI detection across NIST SP 800-171 category markings, FedRAMP-aligned data sovereignty through Hybrid Outpost, NIST 800-53 Rev. 5 control mapping, air-gap deployment for classified and IL4/IL5 environments, and tamper-proof audit evidence for FISMA assessment packages and ATO submissions.

A new technical blog post covers how Arbitex continuously improves the contextual DLP validation tier to reduce false positives on edge cases that matter in production. The post covers accuracy improvement methodology for international identifiers, healthcare data, and developer test fixtures. Aimed at architects evaluating AI DLP approaches for regulated enterprise environments.