Security and data

Where your work lives, and who can see it

The facts a security review asks for first, including what is not in place yet. Last reviewed 12 November 2026.

Where it lives

The application Amsterdam, the Netherlands Railway
The database Amsterdam, the Netherlands, reachable only from the application Railway (PostgreSQL)
Files you upload or capture Cloudflare R2 object storage, in the EU Cloudflare
Email: sign-in links and notifications - Resend
Sign-in with Google or Microsoft, if you use it - Google, Microsoft
Payments, when you buy a plan - Stripe

Sign-in and access

  • Passwords are stored as bcrypt hashes, never as text.
  • Two-factor sign-in with an authenticator app, with recovery codes, in Settings > Security.
  • Ten wrong passwords for one account within 15 minutes pause sign-in for that account.
  • Changing or resetting your password signs out the apps you connected, such as Claude.
  • Owners and editors change work; viewers read it. Lawyers and clients you invite see only the projects they are invited to, and clients see the client view, which leaves out your prompts and workflows unless you choose the archive view.

API keys and connected tools

  • API keys are stored hashed and shown once, when you create them. Each key carries only the permissions you give it.
  • The Claude connector signs in with OAuth. Archibal stores only a SHA-256 digest of each token, and you can revoke a connection at any time.
  • Webhook signing secrets and the sign-in tokens of connected accounts, such as Magnific, are stored encrypted.
  • The AI tools you connect run under your own account with each vendor. Archibal receives what they send it.

Delivered records

  • A record is fixed when you deliver. A later change makes a new delivery; the earlier one stays on record, marked as superseded.
  • Each record carries a SHA-256 hash, shown on its verify page.
  • Verify links use long random tokens, and the pages ask search engines not to index them.
  • Delivered files carry C2PA Content Credentials. Archibal signs with a test certificate for now, so validators show the signer as not on the C2PA trust list until the production certificate is issued.

Your data

  • Settings > Your data downloads your whole workspace as one zip: every file, the delivered PDFs and signed copies, and a readable record of each project.
  • Deleting your account removes your sign-in and your name. Records you already delivered stay valid and their verify links keep working, shown as delivered by a former member.
  • Files dropped on the public checkers - verify a file, read a ComfyUI file - are read and discarded, not stored.
  • We do not sell your data, and the site sets no advertising cookies.
  • Every page is served over HTTPS only, and other sites cannot embed Archibal in a frame.

Not in place yet

SOC 2 or ISO 27001
We hold neither certification.
Single sign-on and SCIM
Sign-in is email and password, or Google or Microsoft. SAML single sign-on and SCIM provisioning are not available.
Data processing agreement
We have not published a standard one. If you need one, write to us.
Production signing certificate
Pending, as described above.

Report a problem

Send security reports to hello@archibal.ai. The same address is in our security.txt. How we handle personal data is in the privacy policy.