How we keep Arterio secure.

• Access to servers, source code, and third-party tools is protected with two-factor authentication.
• We use strong, randomly generated passwords that are not reused.
• Employees and contractors receive the minimum access needed for their responsibilities. Access to production systems and data is restricted.
• Automated dependency vulnerability detection helps us identify known security issues; we prioritize remediation and deploy updates promptly.

Arterio uses WorkOS for single sign-on (SSO), authentication, authorization, and user management. WorkOS maintains a SOC 2 Type 2 attestation.

Only users invited by an authorized administrator of their organization can access Arterio.

Communication between the Arterio application and its backend is encrypted using TLS 1.3. Our application servers run on Fly.io, which supports automatically provisioned and renewed TLS certificates through Let’s Encrypt. Customer database records are hosted by PlanetScale and encrypted at rest and in transit.

Application logs are stored in Better Stack and retained for 7 days before deletion under our configured retention settings. Better Stack maintains a SOC 2 Type 2 attestation.

• Code changes are regularly reviewed.
• Code is tested in a staging environment against a QA checklist before deployment to production.
• Automated tests are run against every code change.
• Feature releases are generally delivered every two weeks; bug fixes and security updates are deployed as needed.

Client and backend dependencies are automatically checked for known security vulnerabilities.

Identified vulnerable dependencies are prioritized for patching and redeployment.

Arterio engages external service providers to support the Service. An up-to-date list of their purposes and processing locations is available on our subprocessor page.

Our subprocessors maintain SOC 2 Type 2 attestations and are subject to contractual data-protection obligations as applicable. Processing locations vary by provider, and we prefer EU processing where feasible; see the current subprocessor list.

Arterio application servers are hosted by Fly.io. Fly.io maintains a SOC 2 Type 2 attestation and operates hardware in ISO/IEC 27001-certified data centers.

Our database is hosted by PlanetScale on AWS infrastructure. PlanetScale maintains a SOC 2 Type 2 report. Customer database data is encrypted at rest and in transit.

Generated PDFs, uploaded images, and CAD drawings are stored in Cloudflare R2. Cloudflare maintains SOC 2 Type 2 and ISO/IEC 27001 certifications. Data locations are described in our subprocessor list.

To report a security vulnerability, contact [email protected]. We will review the report and respond as promptly as practicable.