OAuth-scoped access
Arcive connects through OAuth instead of asking users to share source-system passwords. Connected access can be revoked from the source tool at any time.
Security at Arcive
Your sales data stays yours.
Arcive connects to the tools your team already uses without moving ownership of the underlying content. Access is scoped, customer data stays separated, and your content is not used to train public models.
Encrypted credentials
OAuth tokens and connector credentials are encrypted at rest, and traffic is TLS in transit. Production refuses to start without the encryption key configured.
Tenant isolation in the database
Row-level security is enforced and forced on every table holding customer data. Isolation is a property of the database, not of application code remembering a filter.
No public model training
Customer content is not used to train public AI models, and prompt or answer content is not sent to our observability tooling by default.
Enforced, not promised
How isolation actually holds.
Most security pages ask you to take claims on trust. These are the mechanisms behind ours, stated specifically enough to be checked in a technical review.
The application cannot bypass isolation
Arcive connects to its database as a role that holds no superuser or bypass privilege and owns no tables. If the role it connects with could skip row-level security against a production database, the application refuses to start.
Isolation is re-verified on every change
Our test suite rebuilds the schema and asserts, as the real database roles, that a query scoped to one organization returns zero rows from any other. This runs in CI on every change before it can be deployed.
Permission changes leave an append-only trail
Every administrative change is recorded with the administrator responsible: groups and membership, who can see which sources, roles, invitations, connected sources, and erasures. The database refuses updates and deletions to that trail outright, so the record cannot be quietly rewritten.
Access narrows inside your organization too
Each connected source belongs to a scope that is organization-wide, restricted to named groups, or private to one person. The default is deny, and a permission change takes effect on the next request.
Where your data lives
Every service that touches customer data, and what it sees.
Connected sources like Gong, Salesforce, HubSpot, Slack and Google Drive are your systems. Data flows from them to Arcive, never the other way. Beyond our own infrastructure, these are the services involved in serving you, and what each one holds. The full subprocessor list, naming every vendor, is available on request and forms part of our DPA.
- Managed PostgresAWS eu-west-2 (London)Primary database: all stored data
- Application hostingEU/USData in transit and in process
- OpenAIUSEmbeddings and answer generation: questions and retrieved excerpts
- CohereUSSearch reranking: questions and candidate excerpts
- LangfuseEULLM tracing: metadata only by default
- SentryEU/USError monitoring: scrubbed stack traces and request metadata
- Graph databaseEURelationship graph: people, companies, and document and call titles; no document body content
Your control
Ask a security questionAccess can be revoked. Leaving means deletion.
If your organization stops using Arcive, we delete its data, including ingested content and stored connection credentials, subject only to legal obligations and temporary backup retention.