Security

1. Overview

ARCY AI is currently offered as a BETA product. This page describes the security measures in place today, not the ones we expect to have later.

2. Infrastructure

The platform runs on Amazon Web Services in the European Union. Application data, session data, and behavioral signals are stored and processed within AWS infrastructure, which holds SOC 1, SOC 2, SOC 3, ISO 27001, ISO 27017, ISO 27018, and PCI DSS Level 1 certifications.

All AI processing runs on AWS Bedrock inside that same infrastructure. No request content leaves AWS to reach a separate AI vendor, and Bedrock does not use data submitted through the platform to train foundation models. See our Privacy Policy for what each part processes.

3. Encryption

Data is encrypted in transit using TLS. Data at rest in our database and object storage is encrypted using our cloud provider's encryption-at-rest capabilities. Operator secrets, such as the keys used to verify identity, are encrypted with a managed key service rather than stored in plain configuration.

4. Tenant Isolation

Isolation is logical, not physical. Workspaces share infrastructure, and every dashboard and API request is checked against the organization or application that owns the data before anything is returned. Access is never assumed because a request carries the right URL or identifier.

Dedicated infrastructure for a single customer is not available today.

5. Authentication and Access Control

Dashboard access is managed through Clerk, which is SOC 2 Type II certified. Within a workspace, what a member can do is limited by their role, and administrative actions are restricted to admins and owners.

Access to production infrastructure and customer data is restricted to authorized personnel and scoped to what is needed to operate the platform.

6. What Reaches Us From Your Pages

arcy.js masks values likely to be personal in the End User's own browser, before anything is sent. Images an End User attaches to a message are stored privately and are never reachable by URL alone. ARCY AI holds no standing credential to an Operator's product and never signs in to it.

7. Subprocessors

8. Reporting a Vulnerability

If you believe you have found a security vulnerability in the platform, report it through our contact page so we can investigate promptly. Please do not disclose it publicly before we have had a reasonable opportunity to address it.