How we protect your data
Encryption
TLS 1.2+ in transit. AES-256 at rest. Customer secrets stored in a managed vault, never in plaintext.
Access control
SSO-ready, role-based access, least-privilege defaults, and per-project membership. Audit logs on Enterprise.
Infrastructure
Built on Cloudflare and Supabase with regional data isolation. Production access is logged and reviewed.
Monitoring
24/7 platform monitoring, anomaly detection, and on-call rotation across our engineering team.
Compliance
GDPR-aligned and NDPR-aligned today. SOC 2 Type II in progress with our audit partner.
Data residency
Primary processing in EU and US regions. Africa and Caribbean-region residency available on Enterprise.
Reports & documentation
Available under NDA to qualified prospects, customers, and partners.
Security overview
Architecture, controls, and shared responsibility model.
SOC 2 Type II
Independent attestation across security, availability, and confidentiality.
Penetration test summary
Latest third-party penetration test summary letter.
Data Processing Addendum (DPA)
GDPR Article 28 DPA with SCCs for international transfers.
Subprocessors
We work with a small number of trusted infrastructure partners. We notify customers in writing at least 30 days before adding a new subprocessor that processes personal data.
| Provider | Purpose | Region |
|---|---|---|
| Cloudflare | Edge compute, DNS, CDN, WAF | Global |
| Supabase | Managed Postgres, auth, storage | EU / US |
| Stripe | Payments processing | Global |
| Resend | Transactional email delivery | US |
| OpenAI / Anthropic / Google AI | AI inference for builder features | US / EU |
| Sentry | Error monitoring | US / EU |
Trust FAQ
How do I report a security vulnerability?
Email security@aruwo.dev with reproduction steps. We acknowledge within 24 hours and follow a coordinated disclosure process. Responsible researchers are credited in our hall of fame.
Where is my data stored?
Primary processing happens in EU and US regions. Enterprise customers can request Africa and Caribbean-region data residency and dedicated infrastructure.
Do you train AI models on my data?
No. Your projects, prompts, and content are never used to train foundation models. Inference providers operate under zero-retention agreements where available.
Can I get a DPA or BAA?
Yes — DPA is available on request for all paying customers. BAA is available on Enterprise.
What's your uptime SLA?
Builder and Scale plans receive a 99.9% uptime target. Enterprise customers receive a 99.95% SLA with financial credits.