Trust Center: Security, Data Handling and AI Policy

What Arcesso holds today, and what it does not

Arcesso does not currently hold any security or compliance certification. That includes SOC 2, ISO 27001, HIPAA attestations and PCI DSS. We say this plainly because buyers deserve to know before they share data, and because a claim that cannot be checked is worth nothing.

What Arcesso can show is how we work. The practices on this page are the ones we follow on every project, and we will describe them in detail on a call or in your security questionnaire. Where your industry needs a certified vendor, we will tell you early whether we fit.

Contracts that protect your information and IP

Every Arcesso engagement starts with paper that protects you. A mutual NDA is signed within 24 hours of asking, before you share anything sensitive. The services contract assigns 100% of the code and intellectual property we write for you, from the first commit, in writing.

Our engineers are bound by confidentiality and IP assignment terms that flow through to you. When a project ends, we remove our access to your systems and delete working copies of your data that we no longer need, unless you ask us to keep them for a support retainer.

If your company needs a data processing agreement or a business associate agreement, raise it during scoping. We will review your terms and tell you honestly whether we can sign them as written.

Encrypted environments and least-privilege access

Arcesso builds inside your accounts, so your data stays under your control. Code lives in your repository and apps run in your cloud. Engineers join as named members with only the permissions their task needs, and you can remove them at any time.

• Data encrypted in transit (TLS) and at rest, using the cloud provider's encryption.
• Named accounts only, no shared logins, and multi-factor authentication required.
• Secrets kept in a secrets manager or environment settings, never in code or chat.
• Production access limited to the engineers who need it, and reviewed at milestones.
• Company laptops with full-disk encryption, screen lock and current updates.
• Access removed at the end of the engagement, with a written confirmation.

Secure code: review, testing and dependency scanning

Every change Arcesso ships goes through a pull request that a second engineer reviews before it merges. Reviews check for the usual attack paths: injection, broken access control, unsafe input handling and secrets in code. Automated tests run on each pull request, and failing tests block the merge.

Dependency scanning runs on your repository to flag known-vulnerable packages, and we pin versions so builds do not change silently. For web apps we set security headers, validate input on the server and rate-limit public endpoints.

Arcesso engineers use AI coding tools for drafts and tests, but a named engineer reads, tests and owns every line before it ships. AI-written code gets the same review as any other code.

How client data is handled in AI projects

Arcesso sends client data to AI model providers only when a project needs it, and only under settings that exclude training on your data. We use the business or API tiers of OpenAI, Anthropic Claude and Google Gemini, or open-weight models hosted in your own cloud when data must not leave it.

Before any model call, personal data such as names, emails, phone numbers and account numbers is masked or removed where the task allows. Test sets for evals use redacted or synthetic records. Every agent that can take an action has a human approval step for anything risky.

The full rules, including retention and your opt-out choices, are in the AI Use and Data Policy at /legal/ai-use/.

Our certification roadmap

Arcesso intends to pursue a SOC 2 report as client demand and company size justify it. We have not set a date, and we will not publish one until an auditor is engaged. When work starts, this page will say so, with the auditor's name and the report type.

Until then, our approach is to run the controls first and certify them later. Many of the controls a SOC 2 audit checks, such as access reviews, code review, encryption and vendor management, are already part of how we deliver. Certification would add independent evidence, not new behaviour.

If your procurement team requires a certified vendor today, Arcesso is not the right choice for that contract, and we would rather tell you on the first call.

How to request a security questionnaire or review

Arcesso completes security questionnaires from prospective clients at no cost. Email info@arcesso.ai with the subject line "Security questionnaire", attach your form or tell us which standard you use, and we will reply within one business day with a delivery date.

We can also join a call with your security or IT team to walk through our practices, sign your NDA first, and share our standard contract terms on IP, confidentiality and data handling.

• Your own questionnaire, or a common format such as SIG Lite or CAIQ.
• Our AI Use and Data Policy and Privacy Policy, both public.
• A list of the subprocessors a specific project would use.
• To report a security issue with arcesso.ai, email info@arcesso.ai.