Security and compliance
How Arc0 stores and encrypts credentials, what data it does and doesn't keep, its compliance posture, and where to report a vulnerability.
Arc0 sits between your agents and your users' credentials. What it stores, and how, matters as much as what it lets an agent do.
Credentials never reach the model
An agent never sees a raw access token. When it calls an action or goes through the proxy, Arc0 looks up the connection's credentials in its vault, injects them into the call to the app, and returns only the result — the model's context holds the request and the response, never the token that made it possible. The same is true for API keys and basic auth, not only OAuth.
Encryption
Every connection's credentials are encrypted with a key scoped to your org: "Encryption: Per-tenant key" in Settings → General → Data and security, next to your org id, plan and data region. A tenant's key never protects another tenant's data.
Arc0 API keys follow the same rule in reverse: only a hash is stored, not the secret. The full value is shown once, when you create it.
What's stored, and what isn't
Arc0 keeps: connection credentials (encrypted), your policies and their version history, the audit log, connected user and app records, and webhook signing secrets.
Arc0 does not keep a copy of the data behind those credentials. There's no unified store that mirrors your users' Gmail messages or Salesforce records — an action or a proxy call reads and writes the app directly, on demand, and its payload isn't retained unless you turn on OpenTelemetry payload export, which is off by default and lands in your own backend, not Arc0's.
Compliance
Arc0 is SOC 2 Type II compliant; the report is available on request under NDA. Arc0 is GDPR compliant, and signs a Data Processing Agreement on request.
Data region and dedicated hosting
Scale
Your org is hosted in the United States or the European Union, set once under Data and security. EU hosting requires Scale. Scale orgs can also run on dedicated infrastructure instead of the shared environment, alongside custom audit retention.
Two-factor authentication
The members table (Settings → Members) shows a Two-factor column next to each teammate's role, so an admin can see who has it enabled and who doesn't, across Owner, Admin, Developer and Viewer roles.
Responsible disclosure
Found a vulnerability? Email security@arc0.ai. We don't run a published bug bounty program, but we do respond to reports.
For the full legal detail behind this page, see Security and Privacy on the main site.