Security
Sensitive information deserves more than a password.
Arkup controls who can access your documents, how information is processed and how it can be recovered.
Security status
Protection applied across every workspaceWorkspace isolationActive
Private file storageActive
Server-side permissionsActive
AI access controlsActive
Resource protectionActive
Independent backupsActive
Access control
Role and folder permissions are enforced on the server, not just in the interface. AI only reaches what the person asking may see.
Data protection
Each workspace is isolated, files live in private storage, and connected-account credentials are encrypted.
Recovery & resilience
Independent backups, a documented restore procedure and rate limits on expensive operations.
Security practices in detail
Authentication and access
- Secure sign-in with email and password or Google sign-in.
- Role-based workspace access for owners, admins and members, with folder-level permissions.
- Personal Only Me storage protected by a separate PIN, hashed and rate-limited.
Storage and transport
- All traffic over encrypted HTTPS connections.
- Private file storage with short-lived, re-authorized download links.
- Sensitive extracted fields stored encrypted and masked until unlocked.
Connected accounts
- Standard OAuth authorization — Arkup never asks for a connected account's password.
- Least-privilege, read-only permissions wherever reading is enough.
- Credentials encrypted, never sent to the browser or the AI model; disconnect anytime.
AI processing
- Only information you are authorized to see is used to answer you.
- Customer content is not used to train generalized AI models.
- Text inside documents is treated as data, never as instructions.
Arkup does not currently claim SOC 2, ISO 27001, HIPAA or any other third-party certification. For a security review, contact sales@arkup.ai. See also our Privacy Policy and Data Deletion page.