1. Accounts and authentication
- ArcNest uses Supabase Auth for account registration, sign-in, sessions, email verification, and password recovery.
- Protected ArcNest pages require an authenticated session.
- ArcNest does not write plaintext passwords to its application database.
- Password-reset links are sent to the account email address through the configured authentication email service.
2. Data access
- Row Level Security policies are enabled for ArcNest's main user-content tables and storage areas.
- Private records are associated with an authenticated user. Sharing features use explicit sharing or classmate records.
- Support administration pages require a signed-in email address included in ArcNest's server-side administrator allowlist.
- Privileged Supabase service-role credentials are used only by server-side code and are not intentionally exposed to the browser.
3. Validation and abuse controls
- The public contact form and account-registration flow validate submitted data on the server.
- The public contact form includes a bot honeypot and basic request limiting.
- Account registration includes request limiting and checks for known disposable-email domains.
- Lemon Squeezy and Resend webhook requests are checked using their configured signing secrets before ArcNest processes them.
These controls reduce common abuse but cannot guarantee that every automated or malicious request will be blocked.
4. Hosting and service providers
The public ArcNest website is served over HTTPS. ArcNest relies on configured service providers for parts of its operation, including Vercel for application hosting, Supabase for authentication, database, and storage, Google's Gemini API and OpenAI for requested AI processing, Resend for support email, and Lemon Squeezy for payments.
Notes, files, prompts, or extracted text may be sent to an AI provider when a user deliberately requests an AI feature. Users should not put passwords, payment-card information, secret keys, or unrelated sensitive information in uploads or prompts.
The unpaid Gemini API option may use submitted content and responses to improve Google's products and may involve human review. OpenAI states that API data is not used to train its models by default, but ArcNest's OpenAI organization has logging enabled for supported API calls. Those logged inputs and outputs may be available to authorized ArcNest organization members. ArcNest also requestsstore: false for OpenAI Canvas responses; this does not disable organization logging or provider-controlled abuse-monitoring retention.
5. Payments
Checkout and payment-card entry are provided by Lemon Squeezy. ArcNest stores billing identifiers, order or subscription status, relevant dates, and limited purchase records needed to provide access and handle billing support. ArcNest does not ask users to enter a full card number or card security code into an ArcNest support form.
6. Current limitations
- ArcNest does not currently advertise a formal bug-bounty program.
- ArcNest does not promise continuous human security monitoring or a guaranteed response time.
- No independent penetration test or security certification is claimed on this page.
- No specific backup or disaster-recovery target is promised unless one is published here after being configured and tested.
No internet service can guarantee complete security. Safeguards will be reviewed and updated as ArcNest develops.
7. Report a security concern
ArcNest does not currently operate a separate security@arcnest.space inbox. Use the public form below and choose Security concern. The submission is stored as a high-priority support ticket, and any reply will be sent to the email address provided in the form.
Open the security concern form →