Your data, guarded by design.
Security isn't a checkbox we bolted on. Every mechanism below is built, tested, and enforced in code — not a marketing claim.
Security mechanisms
Encrypted credentials
Data-source secrets are encrypted at rest with AES-256-GCM under a server-held key and never returned to the browser. Every secret gets its own random nonce, and GCM's authentication tag means a tampered or corrupted ciphertext fails to decrypt outright instead of returning garbage. Editing a data source only sends the fields you changed — the encryption layer preserves any secret you didn't touch instead of overwriting it with a blank value.
Tenant isolation
In cloud, cross-tenant isolation is enforced at the database, not just in application code. Every org-scoped table carries a Postgres row-level-security policy, and the app connects as a restricted role that only ever sees rows for the organization set on the current request — fail-closed, so a request with no organization context sees zero rows, never everything. A dedicated test suite drives real HTTP requests against a second organization's data sources, queries, dashboards, and alerts and asserts every one comes back 404, and a build-time check fails CI if a future org-scoped table ever ships without a policy.
SSRF-guarded connectors
Every outbound connector call and webhook-style notification passes through a network guard that resolves the target host and blocks it if any resolved address is loopback, private, link-local, carrier-grade NAT, or a cloud metadata endpoint — including the IPv4-mapped IPv6 forms attackers use to slip past naive checks — before the real network call ever leaves the server. A malicious or misconfigured data source can't be used to probe your own internal network.
No copy of your data
arcodash connects live to your own data source and runs each query against it directly — it doesn't ingest, replicate, or warehouse a copy of your underlying dataset, and there's no bulk ETL step pulling your tables out from under you. What powers dashboards, alerts, and collaboration is the query itself, run against your source on demand. To render results, drive alerts, and avoid re-running expensive queries, the *results* of the queries you run are cached in arcodash for a short window — 24 hours by default, and any run can force a fresh one — but that's a query-result cache, not a replica of your source. Your data stays where it already lives; arcodash reads from it, it doesn't hoard it.
Granular access control
Per-object access control lists (view / modify) on queries and dashboards, groups with per-group data-source access, and secret-token public links for sharing outside the org — people see exactly what you grant, nothing more.
Rate-limited logins
Login, password-reset, and invitation-accept endpoints are rate-limited per IP address by default — 10 login attempts and 5 account-recovery attempts per minute — so credential-stuffing and password-guessing scripts get throttled, not a clean shot at your users' accounts. Query execution, data-source connection tests, and public dashboard access are separately rate-limited per user or IP, so one noisy client can't degrade the service for everyone else.
Audit log
Sign-ins (success and failure), query executions, alert state changes, and outbound notification deliveries are recorded to an org-scoped audit log, so you can answer "who signed in, what ran, and what fired" without digging through raw database history. Coverage is still growing — broader action-level auditing is on the roadmap, not yet shipped.
Sign-in & API auth
Sign in with an email and password or with Google. A failed sign-in shows the same message whether the address or the password was wrong. CSRF protection (double-submit cookie) guards session-based requests, and a separate API-key auth path covers scripts and integrations. Enterprise single sign-on isn't available yet.
Found a problem? Tell us.
arcodash is a small, currently solo-maintained project — there's no dedicated security team or bug bounty program, but reports are taken seriously and handled as a priority. Email [email protected] with a description of the issue, steps to reproduce, and the affected version or component if known. Expect an acknowledgement within 5 business days (best-effort); give us reasonable time to investigate and fix before any public disclosure, and a fix will be credited to the reporter unless anonymity is requested.
Compliance readiness, stated honestly.
arcodash doesn't hold any compliance certifications today — no SOC 2, no ISO 27001, nothing — and we won't claim one we don't have. What we do have, in place today and not promised for later:
- Encryption at rest for every stored credential
- Database-enforced tenant isolation, not just app-layer checks
- Per-object access control on every query and dashboard
- An audit log for sign-ins, query runs, and alerts
These are the same building blocks a compliance program is built on. If your team has a specific compliance, privacy, or data-residency requirement, talk to our team and we'll walk through exactly what we do (and don't yet) support.
Connect a database.
Ship a dashboard.
Sign up, connect a source, and build your first dashboard today — one fixed price.