For a government's own developer
If you write software for a city, county, court, or utility and found this API: it is the same service that runs Aric's government alerting product (Aric Alerts), with the same consent ledger, audit trail, and tenant isolation. You are welcome here; the door in is just different.
The door: organization billing, approved by Aric
Government tenants never self-register, and card payment is never offered on a government account; both are enforced invariants in the code, not policy text. Your route is organization billing: contact Aric Software & Design, your tenant is approved and provisioned, and billing runs as monthly invoices with line items, an explicit grand total, and your purchase-order number, through QuickBooks. Your staff sign in with your own Microsoft accounts and your own MFA policy, or through Aric's managed customer sign-in, never a new password store.
Meanwhile, everything on this site works for evaluation today: a sandbox key enforces every compliance rule with zero carrier traffic, so you can build and demonstrate the integration before any procurement step.
The same API, the same rules
The quickstart, API reference, MCP server, and CLI are identical for government tenants, with two differences in your favor: government messages are never run through the developer content screen, and your jurisdiction's retention rules (for example, three years for court and utility notices) govern your data instead of the developer default.
The answers your auditor will ask for
These come from Aric's compliance master, the control-by-control record kept for every product, and each is backed by automated tests that fail the build if the control weakens:
| Question | Answer |
|---|---|
| Where is our data, and who can see it? | Microsoft Azure, in Aric's own subscription. Each entity's rows are isolated by the database engine itself (row-level security at a single query choke point); Aric staff reach a tenant only through break-glass access that requires a stated reason and is written to that tenant's audit trail. |
| Who owns the data? | The entity. Export-my-data produces one complete package at any time; the retention policy governs deletion; nothing is sold or shared. |
| Is there an audit trail? | Yes: append-only at the database engine (updates always refused), exported to immutable log storage, with alerting on break-glass use and authentication anomalies. |
| Are the text messages carrier-registered? | Yes. Sends run from verified toll-free numbers today; each paying entity gets its own 10DLC number under the campaign registration in progress. STOP, HELP, and quiet hours are enforced in the service. |
| What happens if you are breached? | The incident process runs and the entity is notified within 72 hours, so it can meet its own notice obligations. |
| Is it accessible? | Every screen, this site included, passes WCAG 2.1 AA checks in CI before it can deploy, plus a manual keyboard and screen-reader pass per release. |
| Does card data ever touch Aric? | No. Card billing (developer accounts only, never government) runs on Stripe hosted checkout; government billing is invoice and PO only. |
| Who are your subprocessors? | Microsoft (Azure hosting, SQL, Communication Services for text and email), GitHub (source and build; no customer data), Intuit QuickBooks (billing contact and invoice amounts only), and The Campaign Registry and carriers (10DLC registration details). |
| CJIS? HIPAA? | This service does not touch criminal justice information, and no Aric product is designed for protected health information; Aric does not sign business associate agreements. |
| SOC 2 / ISO 27001? | No third-party audit yet. What Aric shows instead: the compliance master, the security overview, and the automated control tests that run against production. |
Full matrix, current status by control, and anything not answered here: ask Aric Software & Design; the compliance master is shared with customers on request.