Trust & security
Last updated 18 September 2026
This page is for the person who has to get Arkitype past their own security review. It says what is in place, what is not, who else can touch your data, and what we have committed to. Every claim points at the thing that implements it, because a control nobody can check is a promise.
What is in place
Row-level security on every table
Access is decided in the database, not in the application. The browser only ever holds a publishable key, so a bug in the interface cannot widen what an account can reach. Four SECURITY DEFINER predicates hold the whole definition of who may do what.
Where to look: supabase/migrations/ — and tests/schema-billing.test.ts, which executes them
Content Security Policy with a per-request nonce
script-src carries a nonce and 'strict-dynamic' rather than 'unsafe-inline', so an injected script does not run. Every page is rendered per request to make that possible, at the cost of CDN caching.
Where to look: proxy.ts
Encryption in transit and at rest
TLS everywhere, HSTS, and upgrade-insecure-requests. Data at rest is encrypted by Supabase, and passwords are stored as hashes we never see.
Least privilege for operators
The operator console authenticates a named person against a server-side allowlist — never a shared password — and refuses to perform any action it cannot first write to an append-only audit log.
Where to look: lib/admin/guard.ts
Customer-visible audit log
An organization's own administrators can read what was done inside it. The table is append-only, enforced by a trigger, and has no client-writable path.
Where to look: supabase/migrations/20260101000003_billing.sql §18
Data export and erasure, self-service
Every account can download everything it holds as one file, and delete itself, without asking anyone. Erasure is a single transaction that cannot half-succeed — and it refuses when it would destroy other people's work instead of your own.
Where to look: lib/account.ts
Backups with tested restores
Point-in-time recovery, with restore drills recorded rather than assumed. A restore always goes to a scratch project first, never over the live one.
Where to look: docs/OPERATIONS.md
Dependency and supply-chain checks in CI
Every push runs the full test suite, a typecheck, a production build and an audit of every dependency. A known vulnerability fails the build rather than waiting to be noticed.
Where to look: .github/workflows/ci.yml
What is not in place
Said here rather than discovered later. If any of these is a blocker for you, tell us at the qualification stage and we will be straight about whether and when it changes.
No SOC 2 or ISO 27001 report
Neither audit has been performed. If your procurement process requires one, say so early — we would rather tell you now than at the end of a trial.
No third-party penetration test yet
The controls above are real and testable, and none of them have been examined by an outside firm. Responsible disclosure is welcome in the meantime and is covered by a published policy.
Single-region data residency
Your data sits in the region the Supabase project is configured for. Choosing a region per customer, or pinning one contractually, is an enterprise conversation rather than a setting.
SSO and SCIM are available on Enterprise and provisioned by hand
The schema, the verified-domain checks and the enforcement points are in place. Configuring an identity provider is currently done with us rather than self-service.
Subprocessors
Everyone who can touch customer data — can, not just does. We give 30 days' notice before adding one, and you may object.
- Supabase — Database, authentication, and file storage. Data: Accounts, design systems, comments, version history, uploaded images Location: The region configured for the project. Transfers: Standard Contractual Clauses.
- Vercel — Application hosting and content delivery. Data: Requests in transit, and standard server logs Location: Global edge network. Transfers: Standard Contractual Clauses.
- Stripe — Payments, invoicing, and tax. Data: Billing contact, payment method, invoice history. Never design data. Location: United States and Ireland. Transfers: Standard Contractual Clauses.
- Google Analytics — Marketing-page analytics only — never a published styleguide. Data: Page views on the marketing pages, after consent Location: United States. Transfers: Standard Contractual Clauses; consent required before loading.
What we have committed to
- Security incident notification. Affected customers are told within 72 hours of us confirming a personal-data breach.
- Subprocessor changes. 30 days' notice before a new subprocessor starts handling customer data, with a right to object.
- Service discontinuation. At least 30 days' notice and a working export before anything is switched off.
- Data deletion on request. Within 30 days of a verified request, and immediately from the live database when you delete your account yourself.
Reporting a vulnerability
Email security@arkitype.srinidhibhat.com. The policy, including scope and what we ask of you, is at /.well-known/security.txt. We will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it.
Data protection
A data processing agreement is available on Team and Enterprise — see the DPA. Requests under GDPR or comparable law go to privacy@arkitype.srinidhibhat.com and are answered within one month. You can also do the two most common ones yourself, immediately, from Settings → Account: download everything, or delete the account.
The contracting entity is Srinidhi Bhat, trading as Arkitype — a sole trader rather than an incorporated company, and these terms are governed by the law of Karnataka, India.
Questions about any of this? srinidhibhat45@gmail.com