Trust Center

Last updated: September 10, 2026

What this page is. A plain description of how Arikano protects the data you put in it, who else touches that data, how long we keep it, and how to reach us if something is wrong. It is written by the engineers who run the system and is updated when the system changes. We are a small company and we are not yet independently certified against any framework; we say so below rather than imply otherwise.

1. Security practices

These are the controls that exist in the product today. Each one names the code that implements it so a technical reviewer can verify the claim.

Control	What it does	Status
AES-256-GCM credential vault src/lib/encryption.ts, src/lib/credential-manager.ts	Portal passwords are encrypted before they reach the database with a key held outside it. Each ciphertext is bound to its tenant with additional authenticated data, so a record copied between tenants fails to decrypt.	In place
Six-role RBAC src/lib/rbac.ts, src/lib/auth.ts	Owner, Admin, Compliance Lead, Safety Manager, Member, and Auditor roles map to an explicit permission matrix. Every route checks a named permission; there is no implicit admin bypass.	In place
JWT-claim row-level security supabase/migrations/028_rls_jwt_policies.sql, tests/tenant-scoping.test.ts	Postgres row-level security pins every tenant table to the tenant id carried in the verified session token. Application code adds an explicit tenant filter on every query as a second layer.	In place
Tenant audit trail src/lib/audit.ts, /dashboard/audit	Create, update, delete, approve, export, sign-in, and credential events are written to an append-only audit log that owners and auditors can review and export.	In place
Encryption key rotation scripts/rotate-encryption-key.ts	A rotation script re-encrypts every vault record under a new key without downtime, so a suspected key exposure can be closed out the same day.	In place
Dependency audit gate .github/workflows/ci.yml, .github/dependabot.yml	CI fails on any high or critical advisory in production dependencies, and Dependabot opens grouped update pull requests weekly.	In place
Content Security Policy next.config.ts, src/app/api/csp-report/route.ts	A CSP is deployed in report-only mode with violations collected at /api/csp-report. It moves to enforcing once the report stream is clean.	In progress

2. Data handling

Tenant isolation

Every customer is a tenant. Every tenant-scoped table carries a tenant id, Postgres row-level security pins rows to the tenant id in the verified session token, and the application adds its own explicit tenant filter on every query. A static test fails the build if a query on a tenant table appears without one.

Portal credentials

Logins for ISNetworld, Avetta, and Veriforce are encrypted with AES-256-GCM before they are stored. The encryption key lives in application configuration, not the database, and each ciphertext is bound to its tenant so it cannot be replayed under another account. Credentials are decrypted in memory only for the duration of a portal session and never appear in logs, error reports, or model prompts.

Language models

Model providers receive the text needed to answer a request: your message, relevant document excerpts, and content Arikano read from a portal. They do not receive passwords, payment details, or your team's account credentials. Every model call is metered per tenant, and none of our providers train on API inputs under the terms we use.

Export and deletion

A workspace owner can export the entire workspace as a JSON bundle with time-limited download links for every file, and can delete the workspace from Settings. Deletion has a 7-day grace period during which it can be cancelled; after that, storage objects, database rows, and logins are removed by a scheduled job and the action is recorded.

3. Subprocessors

Third parties that process customer data on our behalf. We will notify workspace owners before adding one that handles customer content.

Provider	Purpose	Data	Region
Supabase	Postgres database, authentication, and file storage	All account and workspace data; portal credentials only in AES-256-GCM ciphertext accountworkspacecredentialsbillingtelemetry	United States
Vercel	Application hosting, edge network, scheduled jobs	Request logs, IP address, application data in transit telemetryworkspace	United States
DeepSeek	Primary language model for routing and drafting	Conversation and document text; never credentials or payment data model-io	See provider terms
Anthropic	Language model for the Arikano agent	Conversation text, document excerpts, scanned portal content model-io	United States
OpenAI	Text embeddings for the compliance knowledge base	Document and knowledge-base text for embedding model-io	United States
Stripe	Subscription billing	Billing contact and payment method (held by Stripe, never by Arikano) billingaccount	United States
Resend	Transactional email (alerts, invitations, digests)	Recipient email address and alert contents account	United States
Browserless	Hosted browser automation for portal scans and submissions	Portal session traffic; decrypted credentials in memory only for the session credentialsworkspace	United States
Sentry	Error and performance monitoring, cron check-ins	Error traces and request metadata; credentials are scrubbed telemetry	United States
GitHub	Source control, CI, dependency alerts	Source code and CI logs only; no customer data telemetry	United States

4. Retention

Data	Kept for	How it is removed
Account and workspace records	Life of the account	Deleted with the workspace (7-day grace period, then hard delete)
Arikano chat history	Life of the account, or until you delete the conversation	Conversation delete removes messages immediately
Audit logs	Life of the account (400-day pruning is opt-in)	Weekly retention sweep, per-tenant setting
Vault document versions	Newest 30 versions kept; older superseded versions removed after 90 days	Weekly retention sweep
Soft-deleted files	30 days, then hard-deleted with the stored object	Weekly retention sweep
LLM usage ledger	400 days	Weekly retention sweep
Portal credentials	Until you disconnect the portal or delete the workspace	Immediate hard delete
Database backups	Supabase point-in-time recovery window (currently 7 days)	Provider-managed; rolls off automatically

5. Compliance posture

We do not hold a third-party certification today. The table below is the honest state of each framework customers ask about; a status changes only when there is a report or letter we can link to.

Framework	Status	Note
SOC 2 Type II	Not certified	Controls are documented above; no audit has been engaged.
ISO 27001	Not certified	Not pursued at this stage.
HIPAA	Not certified	Arikano is not designed to hold protected health information.
GDPR / CCPA	In progress	Data export and deletion are self-serve; a formal DPA is available on request.

6. Responsible disclosure

If you believe you have found a vulnerability, email security@arikano.com. We acknowledge reports within 48 hours and will not pursue good-faith research that stays within the scope in our policy. The full policy, scope, and safe-harbor terms are in SECURITY.md.

If we confirm a breach affecting your data we will notify the workspace owner without undue delay, targeting 72 hours from confirmation, and as required by law.

7. Service status

Placeholder. A public status page is not yet published. Until it is, incidents are communicated by email to workspace owners and noted here. Uptime and error rates are monitored internally through Sentry and Vercel.

Related: Privacy Policy · Terms of Service