Security and data protection
This page is written for the person at your firm who has to sign off on a new supplier. It says where data lives, who can see it, how long it is kept, and how to get it deleted.
Two roles under UK GDPR
For the firm's own account (users, billing, audit), ArcGabriel Ltd is the controller. For the client files and the personal data in them, the firm is the controller and ArcGabriel Ltd is the processor under UK GDPR Article 28. The Data Processing Agreement sets out the terms, and it forms part of the Terms of Service every firm signs.
Where data lives
Application and database are hosted in the EEA today. Backups are encrypted with AES-256-GCM before they leave the server and stored in Cloudflare R2. Network-tier firms can have AI inference run in London (AWS Bedrock, eu-west-2). A published path to UK-only hosting for every tier is in the README and the DPA.
Sub-processors
| Sub-processor | Purpose | Location | Notes |
|---|---|---|---|
| Anthropic | AI model inference over document text and images | EEA and United States under Anthropic's data processing addendum; UK-resident inference on Network tier via AWS Bedrock London | Zero data retention arrangement; no training on customer data |
| Amazon Web Services (Bedrock, London) | UK-resident AI inference for Network-tier firms | United Kingdom (eu-west-2) | Optional; Network tier only |
| Railway | Application hosting and primary database | EEA (Amsterdam) | Path to UK-only hosting published in the README |
| Cloudflare R2 | Encrypted off-box backups and retained documents | EEA jurisdiction, with UK region under evaluation | AES-256-GCM before upload |
| Microsoft | OneDrive access via Microsoft Graph, delegated per folder | Customer's own Microsoft tenant | Only folders the firm has granted; revocable |
| Stripe | Payments, invoicing, VAT | EEA and United States | Card details never touch ArcMichael |
| Resend | Transactional and automation email | EEA and United States | Addresses and message content only |
| Meta (WhatsApp Cloud API) via Twilio | WhatsApp template messages and SMS fallback | EEA and United States | Phone number and template content only; switched on per firm |
Changes to this list are notified to firm admins 30 days in advance, with a right to object.
The AI provider
Document text and page images are sent to our AI provider under a data processing agreement with zero data retention, and nowhere else. Document content is fenced as untrusted data in every prompt; model output is never executed. Each run is logged with the input hash, model, token counts and cost.
Consent per folder
Before ArcMichael reads a folder for the first time it shows a permission dialog that names the folder, states what will be read, where it will be processed and for how long it will be kept. The grant records who, when, from which IP address, which folder, which scope, and a hash of the wording shown. Revoking the grant stops reads immediately and is itself logged.
Retention
Two modes, chosen per firm with a per-case override. Analyse and discard: source files deleted when the review completes, evidence thumbnails and findings kept. Retain: source files kept under a retention class (six years by default for compliance evidence) and purged at its end. The default for a new firm is to keep the evidence and delete source files 30 days after the review is shared. Backups expire on a 35-day cycle.
Deletion
A firm can delete a document, a case or a client from inside the app; deletion is soft for seven days, then hard, with the off-box backup copy expiring on its 35-day cycle. On cancellation the account has a 90-day read-only export window, after which data is deleted under the retention schedule. Members of the public can request deletion directly through the data-deletion page. Every deletion is logged.
Authentication and two-factor
Passwords are hashed with argon2id. Sessions are opaque tokens stored hashed, in httpOnly cookies, ended on any password change. Two-factor authentication (TOTP with recovery codes) is available to every user and can be enforced for the whole firm by an admin. Connection tokens for OneDrive are sealed with AES-256-GCM at rest.
Audit ledger
One append-only ledger records actor, firm, action, entity, detail, IP address and time. Authentication, user, admin, billing, consent, review, share and deletion events are kept for as long as the account exists. Admins see their firm's ledger; advisers see only their own actions.
Transport and headers
HTTPS only with HSTS. A strict Content Security Policy on the application and on this site. No third-party script anywhere. Uploaded files are checked by content, quota-limited, and stored under per-firm directories.
Reporting a vulnerability
If you believe you have found a security problem, write to the security address below. We acknowledge within two working days, keep you informed, and do not take action against good-faith research.