Data Protection & Security

Encryption

• • In Transit: All data is encrypted using TLS 1.3
• • At Rest: Stored data is encrypted using AES-256
• • Passwords: Hashed using bcrypt — never stored in plain text
• • API Keys: Encrypted and stored in secure vaults

Infrastructure Security

• • ArcProof is not currently SOC 2 audited or certified; readiness work is in progress
• • Access controls and database row-level authorization protect stored records
• • Dependency and application security findings are reviewed and remediated as part of ongoing maintenance

Access Controls

• • Role-based access control (RBAC) for all internal systems
• • Multi-factor authentication required for staff access
• • Principle of least privilege — employees access only what's needed
• • Audit logging for all administrative actions
• • Regular access reviews and credential rotation

Skill Evidence Protection

Your skill data and competency evidence receive additional protections:

• • ArcProof data is private by default — you control visibility
• • Credentials include cryptographic verification (SHA-256 hashing)
• • Assessment integrity monitored to prevent unauthorized access
• • Evidence sources are linked but raw submissions are never exposed to employers

Data Retention & Deletion

• • Active accounts: data retained as long as your account is active
• • Account deletion: all data permanently removed within 30 days
• • Credentials: verification data retained for public verification URLs
• • Backups: encrypted backups purged within 90 days of deletion

Incident Response

In the event of a security incident:

• • Affected users notified within 72 hours
• • Incident response team activated immediately
• • Full post-incident review and remediation
• • Regulatory authorities notified as required by law