Privacy Policy

At Arch, we are dedicated to protecting your privacy and securing your data. We adhere to rigorous industry standards, including encryption, access controls, and regular audits, to safeguard your workforce data, ensuring compliance with data protection regulations.

Customer Data

As between you and Arch, you retain all right, title, and interest in and to your data, content, records, and files provided to Arch, or made available to Arch by or through your systems, in connection with our services ("Customer Data"). We do not acquire any ownership interest in Customer Data. We host, use, reproduce, transmit, modify, and process Customer Data only to the extent reasonably necessary to provide the services, generate deliverables, support the services, comply with applicable law, and enforce our Terms of Service.

Upon your written request received within thirty (30) days after expiration or termination of the applicable statement of work, we will delete Customer Data from our production systems within a commercially reasonable period, except to the extent retention is required or permitted by law, regulation, legal process, record-retention policy, backup protocols, or internal compliance obligations. We may collect and use analytics, statistics, metadata, and other data related to your use of the services, and may generate de-identified, anonymized, or aggregated data and analytics, provided such data does not identify you or any individual.

Security and Data Handling

We maintain a written information security program with administrative, technical, and organizational safeguards appropriate to the nature of the services and the sensitivity of the Customer Data we process. We will notify you without undue delay, and in any event within seventy-two (72) hours, after confirming any unauthorized access to or acquisition of Customer Data in our possession or control that materially affects it.

You are responsible for securing any systems and access credentials under your control that integrate with our services. Read more about these commitments in our Terms of Service.

Product Analytics and Session Recording

We use product analytics tools to understand how our Site is used. This includes autocapture (tracking of clicks, pageviews, and form interactions) and session recording, which captures interactions such as mouse movements, clicks, and scrolling during your visit so we can reproduce and resolve issues and improve the product. We do not use these recordings to capture sensitive information you enter into password or payment fields.

Subprocessors

We collaborate with the following trusted sub-processors to deliver our services. We maintain a current list of sub-processors at trust.archworks.ai and will provide reasonable advance notice of new sub-processors that process Customer Data. Their privacy policies are available for review:

• OpenRouter – Used for large language models (Kimi K3). Data is stored in the US.
• LlamaIndex – Used for document retrieval and indexing. Data is stored in the US.
• Amazon Web Services (AWS) – Used for core cloud storage, Bedrock model inference, and Lambda compute functions. Data is stored in the US.
• Fly.io – Used for compute virtual machines running our AI agents. Data is stored in the US.
• PostHog – Used for product analytics, autocapture, and session recording. Data is stored in the US.
• Redis – Used for caching and session state. Data is stored in the US.
• Cloudflare – Used for DNS, CDN, and network security. Data is stored in the US.
• Sentry – Used for error monitoring and reporting. Data is stored in the US.
• Axiom – Used for logging and analytics. Data is stored in the US.
• Vercel – Used for hosting and deployment. Data is stored in the US.

SOC 2 Compliance

Arch is SOC 2 Type II certified, reinforcing our commitment to robust security practices. This certification validates our dedication to protecting your workforce data with industry-leading safeguards. You can view more details on our Security page.