Security information, without invented proof.
Arcus is pre-launch for broad public availability. This page reflects the posture we can stand behind today: read-only warehouse access, tenant-scoped application data, encrypted secrets, and a direct request path for security review materials. We are working toward SOC 2 Type II; we do not claim certification yet.
What is ready, and what is in progress.
Tenant isolation
Public and product docs require every application table and route to scope by tenant. Internal data uses tenant IDs and row-level access patterns.
Read-only data access
Arcus connects to customer warehouses with scoped credentials and validates SQL before execution. v1 supported warehouses are BigQuery, Snowflake, and Postgres.
SOC 2 Type II
SOC 2 is on the roadmap and evidence collection is being prepared. Reports, bridge letters, and certification logos are not available for public download.
Request the current review packet.
- Security overviewAvailable by email for qualified prospects and customers. Includes architecture, data handling, and current control status.
- Data Processing AddendumThe public DPA page is available for review; final negotiated terms belong in the customer agreement.
- Security questionnaireSend your standard questionnaire to security@usearcus.ai. We answer from the current implementation, not a generic template.
- SOC 2 and pen test artifactsNot publicly available because Arcus does not claim completed attestation or third-party pen-test reports yet.
Vendor list for launch review.
- VercelApplication hosting and edge delivery for the Next.js app.
- SupabasePostgres, authentication, and storage for Arcus application data.
- AnthropicPrimary LLM provider for agent reasoning and answer generation.
- StripeSubscription billing and payment processing.
- Sentry and PostHogError monitoring and product analytics where configured by environment.
Need security materials?
Email us with your company name, the materials you need, and whether an NDA is already in place. We will either send the current packet or tell you plainly what is not available yet.