Security
How Arc Studio protects your workspace
An overview of the encryption, access control, and infrastructure practices that protect PRD content, evidence, and account data.
Short Version
Encrypted in transit and at rest
TLS 1.3 protects data moving to and from Arc Studio. Stored data, including workspace content, is encrypted at rest with AES-256.
Row-level security on every table
Data access is enforced at the database layer, not just in application code, so a bug in one screen cannot expose another workspace’s content.
The browser never sees privileged credentials
Browser code receives only a public Supabase URL and anon key. Service-role keys, AI provider credentials, and AWS credentials stay server-side.
AI processing does not train on your content
Arc Studio uses Amazon Bedrock with Anthropic Claude models. AWS states Bedrock inputs and outputs are not shared with model providers and are not used to train foundation models.
1. Infrastructure
Arc Studio’s web applications are hosted on Vercel. The backend API runs on Amazon Web Services (ECS). Database, authentication, and file storage are provided by Supabase (built on PostgreSQL).
AI-assisted drafting and review run through Amazon Bedrock, which hosts Anthropic’s Claude models. See our Privacy Policy for details on how AI processing works.
2. Encryption
All traffic to and from Arc Studio is encrypted with TLS 1.3. Data at rest, including workspace content, evidence, and account information, is encrypted using AES-256.
3. Access Control
Every table that holds user or workspace data is protected by row-level security (RLS) policies enforced by the database itself, so access rules apply consistently no matter which part of the application queries the data.
Browser code is only ever given a public Supabase URL and anon key. Service-role keys, AI provider credentials, and AWS credentials are restricted to server-only code paths and are never exposed to the client.
Internal support access to workspace content is limited by default. Escalated access to PRD content requires customer consent and is logged with an actor, timestamp, and reason.
4. Enterprise Controls
Enterprise plans include SSO/SAML and SCIM provisioning, a dedicated security review, and a data processing agreement (DPA). Contact us to start a security review for your organization.
5. Payments
Billing and subscription payments are processed by Stripe. Arc Studio does not store payment card details.
6. Audit Logging & Monitoring
Application audit events, AI generation activity, and escalated support access are logged with an actor, timestamp, and reason. Diagnostic and error logs are retained for limited operational periods to support incident investigation.
7. Reporting A Vulnerability
If you believe you’ve found a security issue in Arc Studio, please email security@encontext.io with details and reproduction steps. We’ll acknowledge reports and follow up as we investigate.
See also our Privacy Policy and Subprocessors list.