Is Areebi SOC 2 certified?

Areebi deploys entirely inside your infrastructure, so your existing SOC 2 controls cover the runtime environment. Areebi provides the audit logging, access controls, and policy enforcement you need to demonstrate compliance to your auditor. SOC 2 Type II certification for Areebi's own corporate controls is planned for 2026; we will publish the attestation when it is complete.

Where is Areebi data stored?

All data stays within your infrastructure. Areebi deploys as a self-hosted Docker image - on-premises, in your VPC, or air-gapped. No prompts, responses, or documents are sent to external servers.

Does Areebi sign BAAs for HIPAA compliance?

Because Areebi runs entirely within your environment, the traditional BAA model does not apply. Your organization maintains full control of all protected health information. Areebi provides HIPAA-specific DLP patterns and audit controls.

Public ledger

Open-source contributions and dependencies

Areebi is built on AnythingLLM, a Mintplex Labs project released under the MIT licence. We commit to upstream-first contributions and to maintaining a public ledger of what we ship back to the community.

Today the counters read zero. We are publishing them anyway. That is the point: the page becomes a forcing function, and you can verify our actual output against our stated commitments.

The ledger (as of 2026-05-20)

Honest numbers, not a marketing chart

We have not validated counters against the GitHub API yet. These are hand-counted, conservative, and explicitly zero where we have nothing to claim.

Repositories tracked

Upstream PRs opened (2026 YTD)

Upstream PRs merged

OSS bugs filed

Security advisories acknowledged

We will switch to GitHub API-backed counters once we have at least one non-zero number to display.

Repositories tracked

The three repositories we report on

If Areebi opens a PR or files a bug somewhere else, it will not show up in the ledger above unless we add the repo here first.

Upstream we depend on

Mintplex-Labs/anything-llm

The MIT-licensed AnythingLLM project that Areebi is built on. All upstream-first PRs target this repository.

View on GitHub

Our maintained fork

mitsubishyy/anything-llm

Areebi's hardened fork of AnythingLLM. All security advisories Areebi files for the platform live here.

View on GitHub

Marketing + Trust Center

mitsubishyy/areebi-website

Source of areebi.com. Open for inspection so prospects can audit the claims we make about ourselves.

View on GitHub

Our pledge

Commitments through Q3 2026

What we promise to do, regardless of customer count or revenue. These commitments survive any quarter where the ledger above still reads zero.

At least one upstream PR per quarter to AnythingLLM through Q3 2026. Counted on this page in real time.

All security findings filed upstream first, with a coordinated window, before any public Areebi advisory.

License compliance verified via npm audit plus a manual SPDX review for every Areebi release.

We do not gate fixes behind enterprise tiers. If a fix benefits the community, it lands upstream.

Stack

Dependencies with licences and source links

The full SBOM lives in the repository. Below are the top-level dependencies that materially shape areebi.com and the Areebi platform.

Dependency	Version	Licence	Purpose	Source
Next.js	16.2.3	MIT	React framework powering areebi.com and the Trust Center.	GitHub
React	19.2.4	MIT	UI library underpinning every component.	GitHub
Tailwind CSS	4.x	MIT	Utility-first CSS framework for the marketing site.	GitHub
Framer Motion	12.38.x	MIT	Animation primitives used in section headers and hero transitions.	GitHub
Lucide React	1.8.x	ISC	Icon set used across the Trust Center and product pages.	GitHub
AnythingLLM (upstream)	tracked at fork tip	MIT	The AI workspace platform Areebi extends. We track upstream tightly and rebase the mitsubishyy fork on every meaningful release.	GitHub

Transitive dependencies are reviewed quarterly via npm audit plus a manual SPDX review. Issues identified become tracked items in the ledger above.

Why publish a ledger that reads zero?

Public accountability. Honest zeros today force real numbers tomorrow. A ledger you cannot silently delete is a ledger that gets non-zero entries.
Upstream first is a posture, not a slogan. If we say it, we have to ship it. This page is the receipt.
Licence transparency. Every dependency we lean on is MIT, ISC, or another OSI-approved permissive licence. No copyleft surprises, no relicensing roulette.

Continue exploring the Trust Center

OSS contributions, responsible disclosure, and CVE history are the same commitment expressed three different ways.

Responsible disclosure CVE disclosure history

View the fork Email security Back to Trust Center

Taking longer than expected.

Reload the page

Open-source contributions and dependencies

Today the counters read zero. We are publishing them anyway. That is the point: the page becomes a forcing function, and you can verify our actual output against our stated commitments.