Security at Arcify

Your business runs on this data, so protecting it is part of the product, not an add-on. Arcify is UK-hosted, every tenant’s data is isolated from every other’s, access within your business is role-based, and everything that changes a record leaves an audit trail.

Arcify is hosted in the United Kingdom. Data is encrypted in transit (TLS), and encrypted at rest by our infrastructure providers. Card payments are handled end-to-end by Stripe — full card numbers never reach Arcify systems.

Every business on Arcify is a separate tenant, and tenant isolation is enforced at the database layer — row-level security policies mean a query from one tenant cannot return another tenant’s rows, and our test suite checks these policies across the schema on every change.

• Multi-factor authentication — available on every login, so a stolen password alone does not open your account.
• Role-based access — you decide which of your people can see and do what, per app.
• Audit trail — sign-ins and changes to records are logged, so you can always answer “who changed this, and when?”.

Changes ship through code review and an automated test suite that includes the tenant-isolation checks above. Third-party processors are limited to the small set listed in our data processing agreement, and our public website runs no third-party trackers at all — see the cookie policy.

If you believe you have found a security issue in Arcify, email support@arcify.co.uk with enough detail to reproduce it. We will acknowledge your report, keep you informed as we investigate, and will not take action against good-faith research that avoids accessing other tenants’ data or disrupting the service.