Security overview

Your estate, kept to yourself.

Arcamira holds a map of your technology estate, so isolation, data ownership and honest disclosure matter more than a feature list. Here is how it's built — including what we don't yet claim.

Last reviewed July 2026 · Questions: hello@arcamira.com

Tenant isolation

Every customer is a separate tenant, isolated at the database layer — not just in application code.

• PostgreSQL Row-Level Security on every table. Isolation is enforced by the database, so a query can only ever return the calling tenant's rows — even if application code has a bug.
• Default-deny policies. Restrictive deny policies block anonymous and un-scoped access by default; a request only sees data once its tenant is established for that transaction.
• Tenant set per transaction. The active tenant is bound for the life of each database transaction and never leaks between requests.

Authentication & access

• Access tokens live in memory, never in the browser's local storage. This closes the most common token-theft path (a cross-site script reading a persisted token).
• Refresh tokens are httpOnly cookies — not readable by JavaScript, scoped to the tenant's domain.
• Role-based access: viewer, editor and admin, enforced on the server for every write, plus platform-level super-admin separation.
• Single sign-on (Enterprise): OIDC/SSO with Microsoft Entra, Google and Okta.

Application hardening

• Rate limiting on every endpoint, keyed per user, with tighter limits on AI, import and sync routes.
• Dependency CVE remediation history. We actively upgrade to clear known vulnerabilities — including the JWT (algorithm-confusion / HMAC-bypass), XML-parser injection, and transitive path-traversal classes — and re-run our authentication test suite on each change.
• Least-privilege database role. The application connects as a restricted role; schema changes run under a separate privileged path.

Monitoring & operations

• Error tracking across API and UI (Sentry).
• Uptime monitoring on the application and API health endpoints.
• Structured, shipped logs for audit and incident investigation.

Data ownership

• Export and erasure on request. A tenant's data can be fully exported or permanently deleted in dependency order, with the operation recorded to an audit log.
• Bring-your-own AI keys (Enterprise). When you connect your own AI provider, the key is stored per-tenant and encrypted; AI features are off unless you enable them.
• No training on your data. Your estate is not used to train any model.

Deployment options

Two ways to run the exact same product — choose the trust boundary that fits you:

• SaaS (the default) — fully managed and multi-tenant, on Vercel, Render and Supabase (data hosted in the EU/US regions of those providers). Nothing to install or maintain.
• Self-hosted — docker compose up in your own environment, single-tenant. Your infrastructure, your data residency, your network boundary. Available on every plan.