Is the Technical Sales Guide secure enough for our principals' data?
These answers describe what was in place on 22 October 2026, and what was still to come. Your security team can ask for the questionnaire answers and the data processing agreement at security@arithim.com.
Security questions and answers
Is my data separate from other customers?
Each customer's data is separated inside the database by row-level security. It is enabled and enforced on every table that holds customer data. Arithim audited all 106 tables on 19 October 2026.
People are limited by role, and sales roles are limited by territory. There are six roles.
How do people sign in?
There are no passwords in the product. People sign in with an emailed link or a one-time code. Two-step sign-in with an authenticator app is available, and a company can require it for its administrators or for everyone. The default is optional.
Each company can set an idle timeout and a maximum session length. People can sign out of every device, and administrators can end a person's sessions.
Can I see who did what?
Administrators can see an activity log of changes, imports, exports, sign-in events and security changes for their company, and export it. The application cannot edit or delete the log, and each entry is chained to the one before it, so tampering is detectable.
How do the API and webhooks protect data?
Administrators create API keys with scopes and an expiry. Keys are stored only as hashes, and a key stops working when its creator leaves, is demoted or is deactivated. Webhook calls are signed with HMAC-SHA256, sent only to https addresses, and blocked from reaching private network addresses.
How is the application itself secured?
Database queries use bound parameters, and user text is rendered as text. CSV exports neutralise spreadsheet formula injection. The only file uploads are CSV or text files for import, which are read and not stored.
Arithim reviewed the whole codebase for security on 19 October 2026 and fixed the findings in code. That was an internal review, not an independent penetration test. The codebase has an automated test suite of more than 200 test files, including tests for tenant isolation and access rules.
Where is my data hosted, and who processes it?
The application runs in Vercel's Frankfurt region (fra1) and the database is Supabase in Frankfurt (eu-central-1), as of 22 October 2026. Arithim acts as a processor for customer personal data, offers a data processing agreement, and gives 30 days' notice of changes to this list.
| Sub-processor | Purpose | Data it receives |
|---|---|---|
| Supabase | Database, sign-in and sessions | All customer data |
| Vercel | Hosting and server functions | Requests and responses, application logs |
| OpenStreetMap Nominatim | Address search when a place is added | Address text only |
| Google Maps Platform | Optional address search, off by default | Address text only |
Is my data sent to an AI provider?
AI features are optional and off until a customer turns them on. Arithim does not currently send customer data to an AI provider. Before it does, the provider is added to the published sub-processor list with 30 days' notice. When AI drafting is used, its output is a proposal that a person approves before anything is saved.
What happens to my data over time?
Companies can set retention periods, and the system deletes data past them each day. Administrators can export and erase a person's data. On request, Arithim exports a company's data.
What policies and incident plan do you have?
Arithim has written security, access control, data protection, incident response, continuity, secure development and supplier policies, available to customers under NDA. The incident response plan has a target of telling affected customers within 24 hours of confirming an incident. The plan has not yet been rehearsed.
Are you ISO 27001 certified?
Not yet. Arithim is preparing the Technical Sales Guide for ISO/IEC 27001 certification and is not yet certified.
Not yet available: single sign-on for enterprise identity providers, and an independent penetration test.
Where do I report a vulnerability or ask for the data processing agreement?
Email security@arithim.com. Ask there for the DPA, the sub-processor list and the policy pack.