How ARC1 is secured.

Report a vulnerability

Write to security@lockedinlabs.ai. Please do not open a public issue. Include the version, how it is deployed and a reproduction that uses synthetic data. Never send real credentials, enrollment, device or SCIM tokens, identity-provider secrets, transcripts or customer data.

These are the vulnerability-handling targets. Support hours, the support channel and escalation are named in the design partnership agreement before go-live. Fixes go into the latest release, and a self-hosted customer hears of a security release through the support channel agreed in its design partnership agreement.

Controls in the product today

Each line is implemented in the product today and held by automated tests.

Tenancy

Every table of organization data carries row-level security, enabled and forced. References between tables are composite organization keys, so the database refuses to link one organization's records to another's. In production, the server refuses to start on a database role that is a superuser, bypasses row security or owns the tables.

Sign-in

OpenID Connect with PKCE, state and nonce. People are matched by the identity provider's stable subject, never by email address. A second factor is required by default. A leaver removed in the directory loses every device, enrollment token and session in one transaction.

Sessions

Opaque 256-bit tokens in HttpOnly, SameSite=Lax cookies, stored only as SHA-256 digests: 12 hours absolute, 2 hours idle. Roles are read again on every request.

Secrets

Enrollment, device and SCIM tokens are shown once and stored as digests. Integration credentials are references resolved at the moment of use, from the environment or HashiCorp Vault, and are never logged or returned.

Signed audit chain

Every registration, approval, role change and policy change is an Ed25519-signed receipt, chained to the one before and written in the same transaction as the change. The application role cannot edit or delete a receipt. You can anchor the head of the chain in retention-locked storage outside the database. Anyone holding an export can verify it offline with ace audit verify against a signer they have pinned.

Approvals

Nothing is approved until an approver says so, and the person who asked for a change cannot approve it.

The browser

The content security policy allows this origin only: no CDN, no font host, no analytics, no inline script or style. The application escapes or builds untrusted values as text. The public site’s compiled views use controlled templates; arbitrary source data is not accepted as HTML.

Usage metadata only

The usage reporter excludes prompts, replies, source code and local paths. Optional Ask sends authorized questions and evidence excerpts to a configured provider. The console sits beside the request path; an optional ARC1 Gateway is a separate runtime.

Supply chain

Every dependency is pinned to an exact version. The repository's safety check scans every tracked file, and on request a range of commits, for credential shapes, home-directory paths, private email addresses, machine network names and image metadata. It runs on the engineer's machine from the repository's own scripts, as does the CycloneDX software bill of materials generated from the lockfile.

Assurance documents

The current assurance status, the architecture and data-flow documentation and the threat model are provided under NDA on request from security@lockedinlabs.ai.

For the data boundary, retention by dataset and where data goes, see Trust.