01
Infrastructure
Arci runs on Vercel (compute) and Supabase (Postgres + auth). Both are SOC 2 Type II certified. All data is encrypted at rest (AES-256) and in transit (TLS 1.2+).
Security
How we protect your data.
Arci holds a company's positioning, its customer conversations and its market intelligence. That is not data we treat casually.
Posture
Six things that are true by default.
Not a certification page. These are properties of how the system is built, and they hold whether or not anyone is watching.
02
Tenant isolation
Every database table uses Postgres Row-Level Security. Queries are automatically scoped to your organisation via a JWT claim; no application-layer WHERE clause is relied on alone.
03
Secrets
API keys, webhook secrets and bring-your-own-key credentials are stored as bcrypt-hashed values. Plaintext is shown once at creation time and never logged or stored.
04
Audit log
Every mutating action is appended to an immutable, time-partitioned audit table via a security-definer RPC. The log is available to organisation owners in the product.
05
AI and data use
Arci never trains models on your data. Prompts sent to model providers include only the minimum context the task requires, and no customer content is retained in provider systems.
06
Responsible disclosure
Found a vulnerability? Email security@flares.in. We aim to triage within 24 hours and resolve critical issues within 72 hours.
Still have a question?
Email security@flares.in and a person answers. For how data is collected and retained, read the Privacy Policy.
Get started
Your market intelligence, kept yours.
No training on your data. No content retained in provider systems. An audit log you can read.