Security

Accounts are managed by our identity provider. Passwords are hashed with a memory-hard algorithm and never stored or logged in plain text, and we never see the password you type into a third-party sign-in.

Sessions are held in HTTP-only, secure cookies, so page scripts cannot read them. Signing out revokes the session server-side rather than only clearing the browser.

Access control is enforced in the database with row-level security, not in application code. Every query runs as the signed-in user, and a row you have no role on is not a row you can read - a bug in a page cannot widen that, because the page is not what decides.

Roles are owner, administrator, editor, commenter, and viewer, scoped to an organization. Invites are single-use, expire, and are stored hashed, so a leaked database row is not a usable invitation.

All traffic is TLS 1.2 or better, with HTTP Strict Transport Security. There is no plain-text HTTP endpoint.

Data is encrypted at rest by our database and storage providers. Files you export are handed back through signed URLs that expire after 24 hours rather than through a public bucket.

AI calls happen on the server. The provider API key never reaches the browser and is not present in any client bundle.

A prompt contains the current project and your current selection, and nothing else - never another organization's data. Your content is not used to train models, which is enforced by our provider account configuration.

Every AI result is a preview you accept or reject, and every AI output is validated against the same schema a human edit is validated against before it can touch the model.

There is no import today. Nothing in the product accepts a file: every exchange format we support is written out, none is read in, so the hostile-input surface described here does not exist yet and this section claims no protection you are currently relying on.

Importing a file from an unknown source will be the most hostile input this product takes, and these are the rules it will be built to when it ships. Uploads will be size-capped and type-sniffed rather than trusted by extension, and parsing will run in a worker with a timeout so a malicious file cannot hang a server.

• XML parsing will run with entity expansion disabled, which closes the billion-laughs and external-entity classes outright.
• A .qea file is a SQLite database, so it will be opened read-only, with a query timeout, and nothing it carries will be executed.

Secrets live in the deployment platform's encrypted store, never in the repository. The service-role database key is used by exactly two server-side paths and never by a browser.

We keep structured logs of exports and AI runs for debugging and abuse detection. Logs record what happened and to which record, not the contents of your model. Access to production data is limited to people who need it.

The database is backed up daily with point-in-time recovery, and backups are encrypted. Deleted content ages out of backups within 30 days.

Rate limits apply to AI routes, invites, and exports, per user and per organization.

Report anything you find to security@archyno.app. Include enough detail to reproduce it. We aim to acknowledge within two business days and to tell you what we plan to do within ten.

We ask that you:

• test only against your own account and your own organization;
• do not run denial-of-service tests, spam, or social engineering against our staff or customers;
• do not access, modify, or keep data that is not yours - stop at proof and tell us;
• give us reasonable time to fix the issue before disclosing it publicly.

Do that and we will not pursue legal action over your research. We do not run a paid bug bounty yet, but we will credit you if you want the credit.

The providers we rely on to run the service, each under a data processing agreement. The same list appears on the privacy page, because the two must never disagree.

We would rather you learn this here than from a questionnaire. As of the date at the top of this page:

• we hold no SOC 2, ISO 27001, or equivalent certification, and we do not claim to be "compliant" with one;
• we have not commissioned an independent penetration test;
• we offer no contractual uptime guarantee, and there is no service level agreement on any plan;
• two-factor authentication, audit-log export, and SSO are planned, not shipped.

When any of that changes, this section is where it will change first. Export your work regularly regardless of what we or any other vendor tells you.

Security questions and reports: security@archyno.app. For data protection questions see the privacy page.