Controls
The safeguards in place across Arbium's infrastructure, desktop app, and engineering process.
Infrastructure security
- Production network isolated from the internet
- Production segregated from other environments
- DDoS protection and rate limiting
- Hardened, automatically patched hosts
- Secrets kept in a dedicated secret store
- Infrastructure managed as code
Data protection
- Data encrypted at rest
- Data encrypted in transit
- AI model providers don’t train on or keep your data
- Customer data not used for model training
- High-availability databases
- Daily backups with point-in-time recovery
- Customer data deleted on request
On-device protection
- No screenshots or screen recording
- Capture blocked for chosen apps and sites, on device
- Secrets redacted before upload
- Payment card numbers redacted before upload
- Social Security numbers redacted before upload
- Users can pause capture at any time
Identity & access
- Single sign-on (SSO)
- Role-based access control
- Production access restricted to authorized personnel
- SCIM user provisioning
- Tenant data isolation
- Credentials stored as hashes
- Audit logging of administrative actions
Secure development
- Code review required before merge
- Automated testing on every change
- Dependency vulnerability monitoring
- Container vulnerability scanning
- Least-privilege deployment pipeline
- macOS app signed and notarized
Incident response
- Public vulnerability disclosure policy
- Customers notified of security incidents without undue delay
- Vulnerability reports acknowledged within 2 business days
- Advance notice of sub-processor changes
- Advance notice of planned maintenance
Resources
Public documents open directly. Locked documents are shared on request, with an NDA where a document needs one.
Reports & agreements
Policies
- Acceptable Use Policy
- Access Control Policy
- Asset Management Policy
- Backup And Restoration Policy
- Business Continuity And Disaster Recovery Policy
- Change Management Policy
- Code Of Conduct Policy
- Data Classification Policy
- Data Protection Policy
- Data Retention And Deletion Policy
- Incident Management Policy
- Information Security Policy
- Key Management And Cryptography Policy
- Logging And Monitoring Policy
- Network Security Policy
- Password Policy
- Physical Security Policy
- Responsible Disclosure Policy
- Risk Assessment Policy
- Software Development Policy
- Third-Party Risk Management Policy
- Vulnerability Management Policy
Subprocessors
Third parties that handle customer data for the Arbium-hosted service. Organization customers get advance notice before we add or remove one.
Google Cloud Platform • Cloud infrastructureUnited States
Google Gemini • AI model providerGlobal
WorkOS • AuthenticationUnited States
Sentry • Error monitoringUnited States
PostHog • Product analyticsUnited States
Resend • Email deliveryUnited States
Cloudflare • Website hostingGlobal
Amazon Web Services • AI model provider, for deployments in your own cloudUnited States
Frequently asked questions
Something else? Write to security@arbium.ai.
Does Arbium take screenshots or record my screen?
No. Arbium captures text only. It never requests screen recording permission and never captures images.
Can my administrator read what I was working on?
No. Administrators cannot read captured content.
Do AI model providers keep or train on my data?
No. Model providers process your content only to answer a request, and short-lived caches expire within minutes. Nothing is used for training, by them or by us.
Can I keep Arbium out of certain apps or websites?
Yes. Arbium does not capture apps and sites you block, and the rules are enforced on your device. In an organization, administrators can also set rules for everyone.
Where is my data stored?
On the Arbium-hosted service, on Google Cloud in the United States. If you run Arbium in your own cloud, it is stored in your account.
Can we run Arbium in our own cloud?
Yes. Arbium can be deployed in your own AWS, Google Cloud, or Azure account by arrangement. Talk to us.
How do I stop capture or delete my data?
Pause or quit the app at any time. To delete your data, write to privacy@arbium.ai, or to your organization if it provides your seat.
How do I report a vulnerability?
Email security@arbium.ai. We acknowledge every report within 2 business days. See our disclosure policy.