Security and data handling
How Arc protects merchant and subscriber data, and how to report a problem. The details are in the privacy policy and the data processing agreement.
How Arc protects data
Each line below is a behavior of the running app that has a test behind it.
- Available
Every database read and write is scoped to the store making the request, so one store's data is never returned to another.
- Available
Shopify access tokens, connector credentials and webhook secrets are each encrypted before they are stored, under a versioned key that can be rotated without orphaning what is already saved.
- Available
A subscriber's portal session lives on the server, expires on its own after a short idle time and a daily limit, and can be revoked. A copied cookie is refused once the session has expired or been revoked.
- Available
Before text a subscriber typed goes to a language model, personal details such as emails, phone numbers and card numbers are removed, and providers that are not on the published sub-processor list never receive it.
- Available
Spreadsheet exports neutralize any cell a spreadsheet would run as a formula, so exported subscriber text cannot execute when it is opened.
Arc holds no third-party security certification and no audit report, and none is claimed here. Where a measure is not listed on this page, it is not claimed.
Service providers
Arc shares personal data only with providers that help run the service, such as cloud hosting, email delivery, error monitoring and AI processing for specific features. Payments are handled by Shopify.
The current list of sub-processors is in the data processing agreement. Merchants are told by email before a sub-processor is added or replaced, and can object in writing.
The documents
Read the Privacy policy and the Data processing agreement for data categories, retention, transfers and your rights.
Report a security problem
Email security@arcsubscriptions.com with what you found and how to reproduce it. We read every report. Please do not access data that is not yours, and give us a chance to fix the problem before you publish it.
The same contact is published in the security.txt file that security researchers look for.