Security
Archon handles business conversations, customer data, and third-party integration credentials on behalf of our subscribers. We take this responsibility seriously. This page documents our current security practices honestly — including what we have in place and what we are still building.
Infrastructure
Hosting: Archon's database is hosted on Supabase, a managed PostgreSQL platform providing network isolation, role-based access controls, and infrastructure-level security.
Authentication: Subscriber authentication is handled by Clerk. Clerk provides secure session management, password hashing using modern cryptographic standards, and supports multi-factor authentication (MFA).
Network: Our infrastructure is protected by firewall rules with a restrictive allowlist. DDoS protection is in place at the network layer.
Transport: All data transmitted between your browser, our applications, and our servers is encrypted using TLS 1.2 or higher. Unencrypted HTTP connections are not permitted.
Application Security
Authentication and authorisation: Every API endpoint that handles subscriber data requires a valid authenticated session. Unauthenticated requests are rejected. API keys are hashed before storage — we never store plaintext API keys.
Rate limiting: All API endpoints are rate-limited to protect against abuse and brute-force attacks. Authentication endpoints have stricter limits.
Input handling: We apply input validation and sanitisation across the platform to reduce injection and abuse risks.
Password security: User passwords are never stored in plaintext. We use cryptographic hashing via Clerk's authentication system.
Data Security
Data in transit: All communications are TLS-encrypted.
Data at rest: Database contents are stored on Supabase with infrastructure-level encryption.
Known limitation: OAuth access tokens (for Facebook, Instagram, WhatsApp, and Gmail integrations) are not currently encrypted at the column level within the database. We are actively implementing column-level encryption for these tokens, targeted for Q3 2026. We are transparent about this because accuracy matters more to us than appearing more secure than we are.
Credential handling: Third-party API tokens and secrets are stored as environment variables, not hardcoded in source code.
Access Controls
- Access to production systems is restricted to authorised personnel only
- We follow the principle of least privilege — personnel have access only to what they need
- The Archon team undergoes internal security awareness as part of onboarding
Security Testing
The Archon platform has undergone internal security review conducted by the founding team, which has a professional background in penetration testing and offensive security research. We apply an attacker mindset to our own codebase.
We do not currently hold third-party penetration test certifications, but plan to commission an independent penetration test as part of our SOC 2 preparation.
Compliance Roadmap
| Item | Status |
|---|---|
| OAuth token column-level encryption | In progress — Q3 2026 |
| Automated database backups | In progress — Q3 2026 |
| Independent penetration test | Planned — Q4 2026 |
| SOC 2 Type I | Target — 2027 |
| Backup and recovery testing | Planned |
Incident Response
In the event of a security incident affecting subscriber data:
- We will investigate and contain the incident as rapidly as possible
- Affected subscribers will be notified without undue delay and within 72 hours where required by GDPR
- We will provide details of what happened, what data was affected, and what steps we have taken
To report a suspected security incident or vulnerability, contact legal@archon.qd.je. We commit to acknowledging security reports within 48 hours.
Responsible Disclosure
If you are a security researcher and have identified a potential vulnerability in Archon, we welcome responsible disclosure. Contact us at legal@archon.qd.je before public disclosure to give us the opportunity to investigate and remediate. We will not pursue legal action against good-faith security researchers who follow responsible disclosure practices.
Third-Party Security
Archon relies on third-party services. Each maintains their own security programmes. Links to their security documentation:
Contact
Security and vulnerability reports: legal@archon.qd.je
General security questions: hello@archon.qd.je