Security at ARXD Technologies
Security is a property of the platform, not a page on a website. This page describes what we actually do to protect customer data — and how to tell us when we have got something wrong.
Tenant isolation
Every record is scoped to a customer, and that scope is enforced in the queries themselves — not only in the request handler that reached them. A portal user cannot read another customer's device, ticket or invoice even by guessing an identifier.
Least privilege
Staff access is granted on the server, never self-service. Administrative actions are gated by explicit permission checks, and the highest-privilege console is only reachable by platform staff.
Encryption in transit
All traffic is served over TLS, and the browser is asked to talk to us over HTTPS only. Sensitive values (integration secrets, tokens, key material) are stored encrypted at rest rather than in plain text.
Audited actions
Meaningful actions are written to an append-only audit trail with the actor, the target and the time. Support and administrative work is reconstructable after the fact.
Backups & recovery
The database and the application are backed up on a schedule and restored on a documented, tested path. Recovery is a rehearsed procedure, not a hope.
Monitoring
The platform watches itself: login failures, rate-limit trips and error rates are recorded, and the public status page reports what the platform can genuinely observe about its own health.
Reporting a vulnerability
If you believe you have found a security issue in the ARXD platform, we want to hear about it.
Email security@arxd.org with enough detail to reproduce what you found. Please give us a reasonable opportunity to investigate and remediate before disclosing it publicly.
We do not operate a paid bug-bounty programme. We do credit responsible reporters, with their permission, when a fix ships.
Compliance, stated plainly
We are not going to claim certifications we do not hold. What we can say is that the platform is built from the ground up around the controls that audits ask about — tenant isolation, access control, auditing and retention — so that evidence is available when a customer's own review or compliance obligation calls for it.
If you are evaluating us against a specific framework, tell us which one and we will walk you through exactly which controls we have, and which we do not.