Security Overview

Last updated: 9 August 2026

This page describes controls that are implemented and tested today. We do not claim certifications we do not hold.

Access control

• Deny-by-default authorization: every API surface requires a registered guard, and every organization role maps to explicit capabilities with no wildcard access.
• Tenant isolation enforced in the database with row-level security and verified by an automated cross-tenant test suite.
• Sensitive actions (role changes, API keys, sending-domain changes, seat purchases) require recent re-authentication.
• Platform administration is database-backed, break-glass access requires a recorded reason, and every grant change is audited.

Data protection

• Candidate contact details are released only through consented, credited, audited unlocks; documents and media are served with short-lived signed URLs from private storage.
• Uploads are validated by content (not filename), scanned, and quarantined when suspicious; document processing runs inside strict cost budgets.
• Encryption in transit everywhere; data encrypted at rest by our hosting provider.

Auditability

Privileged access, contact reveals, exports, consent changes, legal holds, and deletions all write append-only audit events. Organizations can export their audit history; candidates can see who accessed their data.

Reporting

Report suspected vulnerabilities to engage@thearq.ai. We acknowledge reports promptly and keep reporters informed.