Data privacy
Arca does not use customer data to train general-purpose AI models. Our security policy and DPA set out this commitment.
Security for life-sciences work
Protect research, clinical, and regulatory work. Review how Arca handles your data, choose the right deployment, and get evidence for your security team.
Trust Center and reportsRead security documentsSecurityData protection
Data protection
and access controls
The controls that protect your documents and workspace data.
Encryption
Our security policy requires encryption of customer data at rest and TLS 1.2 or higher in transit.
Shared hosting
Standard Arca hosting uses shared infrastructure. Organization boundaries and resource permissions logically separate customer work.
Access control
Organization membership and resource permissions govern access to research and regulatory work. Enterprise SSO can connect your identity provider.
Retention and deletion
Arca stores documents, conversations, and outputs to provide the service. Retention and deletion follow your agreement and applicable law.
Connector permissions
Connected accounts determine what Arca can import or query. Review account permissions and the Arca audience before sharing connected content.
Deployment and reviewKnow what is standard.
Know what is standard.
Agree what is optional.
Start with shared hosting. Review dedicated or EU deployment requirements separately before uploading sensitive data.
SOC 2 Type II
Arca's Trust Center lists SOC 2 Type II and provides a report request. Review the report's scope and audit period with your security team.
Enterprise sign-in
Discuss SSO requirements and your identity provider during your security review. Confirm the configuration for your organization before rollout.
Optional EU deployment
Discuss EU hosting requirements with us. Confirm storage, model processing, subprocessors, and cross-border transfers in your agreement. EU-only processing is not a default commitment.
Optional dedicated deployment
Dedicated deployments use separate application and data resources. They are not standard shared hosting, and some supporting services may remain shared. Confirm the scope with us.
Evidence
Documents for your security review
Read our policies. Request reports and deployment-specific terms before approval.
FAQsFrequently asked
Frequently asked
questions
Answers to common questions about how Arca handles and protects your data.
Does Arca use our data to train AI models?
No. Arca does not use customer data to train general-purpose AI models. Our Data Processing Agreement and security policy set out this commitment.
What do model providers receive and retain?
AI requests send prompts and relevant context, which can include document content, to model providers to generate a response. Our subprocessor list identifies providers, including Anthropic and OpenAI. Our subprocessor guidelines require no model training on customer personal data. Provider retention is separate from Arca storing workspace data. Confirm the applicable provider terms and retention arrangements during your security review; this page does not promise zero retention across all providers.
How long does Arca keep our data?
Arca stores documents, conversations, and outputs to provide the service. Retention depends on customer instructions, contractual commitments, and legal obligations. Our data lifecycle policy covers deletion and backup handling. We do not delete all workspace data after each AI request.
Can we request deletion of our data?
Yes. Request deletion at security@arca.inc. Arca fulfills requests as soon as reasonably practicable, subject to legal retention requirements and the DPA. Confirm the scope and timing, including backups, for your agreement.
Do connectors copy each user's source permissions?
Do not assume so. A connector uses its connected account's permissions to import or query data. Imported content is subject to Arca's Library and sharing permissions, which can differ from each user's permissions in the source system. Review the connected account, import scope, and intended audience before enabling a connector. Revoking integration access does not itself establish that previously imported data has been deleted.
Is every workspace dedicated or hosted in the EU?
No. Standard hosting uses shared infrastructure with logical customer separation. Dedicated deployments and EU hosting requirements need a separate discussion and agreement. A dedicated deployment does not automatically mean every supporting service or model provider is dedicated or EU-based. Review processing locations and transfer safeguards before rollout.
Where can our security team review reports and terms?
The Trust Center provides access requests for the SOC 2 Type II report and penetration test. Read our DPA, security policy, and incident response policy. Contact security@arca.inc for questionnaires, deployment-specific evidence, and contract questions.
