Security and Vulnerability Disclosure

1. How we protect data

• TLS for all traffic; application-level AES-256-GCM encryption for model keys, integration tokens, environment variables and two-factor secrets.
• Hashed passwords and tokens, short-lived sessions in HttpOnly cookies, optional two-factor sign-in, and single sign-on and SCIM on the Team plan.
• Server-enforced roles; agents are separate principals and cannot approve their own high-impact actions.
• Hosted agents run in locked-down containers with filtered network egress.
• A hash-chained audit log of human and agent actions, kept at least 365 days.
• Secret scanning, static analysis, dependency audits and tests on every change.

2. Reporting a vulnerability

Email security@joinarchon.com with a description, the affected URL or component, steps to reproduce and the impact you see. Please do not include other people's personal data. We will acknowledge your report within 3 business days, keep you updated, and tell you when it is fixed. We aim to fix critical issues within 30 days. With your agreement we will credit you once the issue is fixed.

Our security.txt follows RFC 9116.

3. Scope

In scope: joinarchon.com, app.joinarchon.com, the Archon API, the Archon command-line tool and desktop agent.

Out of scope: apps customers host on Archon (report those as abuse or to their owner), third-party services we use, denial-of-service, social engineering, physical attacks, spam, and reports from automated scanners without a demonstrated impact.

4. Testing rules

• Use only accounts you own or have permission to use, and stop as soon as you reach data that is not yours.
• Do not degrade the service, run high-volume automated scans, or keep, copy or share data you access.
• Give us reasonable time to fix the issue before you disclose it; we ask for 90 days or until a fix is released, whichever is first.
• Do not demand payment for a report. We do not run a paid bug bounty at this time.

5. Safe harbor

If you make a good-faith effort to follow this policy, we consider your research authorised, we will not take or support legal action against you for it, including under anti-hacking or anti-circumvention laws or our Terms of Service, and if a third party takes action against you we will make it known that you acted under this policy. This does not authorise testing of third-party systems. If you are unsure whether something is allowed, ask at security@joinarchon.com first.

6. Security incidents

If an incident affects customer data, we notify affected customers without undue delay, and within 48 hours under our Data Processing Agreement, and report to authorities as the law requires, including CERT-In within 6 hours of noticing a reportable incident under the Indian CERT-In Directions of 28 April 2022.