Infrastructure
Where ARCY runs, how data is encrypted, who on our side can reach it, and where to read live status.
The answers a security questionnaire asks about hosting and access. For the legal Security section governing the relationship, see arcyai.com/security.
Hosting and encryption
- ARCY runs entirely on Amazon Web Services (AWS) in eu-north-1 (Stockholm, Sweden): hosting, database, storage and AI inference through Amazon Bedrock. A data-residency requirement beyond this goes through Data processing agreements before you sign.
- All traffic between your Product, the dashboard and the ARCY backend is encrypted in transit with TLS 1.2 or higher.
- Database storage and application secrets, including your environment's Secret, are encrypted at rest.
- Database access is private and does not traverse the public internet.
- The database runs on a managed service with automated backups on a recurring schedule.
- AI inference runs through Amazon Bedrock, so request content never leaves AWS to reach a separate AI vendor. Amazon Bedrock may answer an inference request from another AWS region in the EU. What Bedrock keeps after a call is on How AI request content is handled.
- arcy.js, the script on your own page, carries no external runtime dependencies.
Tenant isolation
Isolation is logical. Every workspace and every Product share infrastructure, and every dashboard and API request is checked against the workspace or Product that owns the data before anything is returned. The check runs on every request, never assumed from a URL or an id.
Dedicated infrastructure is not offered today. If it is a requirement for your evaluation, say so through Data processing agreements.
Who on our side can reach your data
- Access to production data and infrastructure is limited to a small team. Each person uses an individual account with MFA, never a shared credential.
- Access is granted on a least-privilege, need-to-know basis.
- Nobody on the ARCY team reads your production session data without a support request you opened.
Incidents and status
Live system status and any ongoing incident are posted at status.arcyai.com. There is no formal incident response or breach notification commitment yet; write that into your questionnaire as it stands. Vulnerability reports go through Responsible disclosure, and that inbox is monitored continuously.