Security and data protection

• Passwords are stored as Argon2id hashes with a per-password salt. Nobody at Arborion can read a password, and we will never ask you for one.
• An email address is confirmed before any study can be created.
• Repeated failed sign-ins lock an account temporarily rather than allowing an unlimited guess rate.
• Sessions live in httpOnly cookies that no script on the page can read, so a script injected anywhere cannot steal a session. The browser never holds an API token it could leak.
• Access tokens are short-lived and rotate. Signing out, or changing a password, ends every session at once.

Every study belongs to an owner, and every query that reads one is scoped by that owner in the data layer. There is no route in the API that can list studies across accounts. Files are namespaced by user before project, so one engineer’s working store cannot collide with another’s.

• Everything is served over TLS. HTTP Strict Transport Security is set, so a browser will not fall back to an unencrypted connection.
• The database, the file store and the secret store are Azure managed services in the Central India region, encrypted at rest.
• The API is not reachable except through the AQRA application, which presents a shared gateway credential on every call. A request without it is refused before it reaches a route.
• Secrets live in Azure Key Vault and are injected at run time. None are in the source code, and the deployment pipeline signs in with a federated identity rather than a stored credential.

Card details are entered on Razorpay’s own checkout and never touch our servers, our logs or our database. What we store is the plan, the amount, the date and the gateway’s reference. A payment is credited to an account only after its cryptographic signature is verified against our server-side secret, and the gateway’s signed webhook is checked the same way, so a forged callback grants nothing.

Significant actions are written to an audit log with the account, the time and the originating address: sign-ins, study changes, runs, report issues, payments, promotional codes and access granted by us. A result records the inputs it was computed from, so a study can never quietly present a number produced from different data.

• Every change runs an automated test suite before it can be deployed, including tests that assert the access gate refuses work it should refuse.
• Dependencies are pinned and the deployed image is built from source on each release rather than assembled by hand.
• A failed rollout rolls back to the previous revision automatically.
• Database changes are versioned migrations applied by the pipeline, never by hand against a live database.

We are a young company and we do not hold ISO 27001 or SOC 2 certification today. We would rather tell you that than imply otherwise. If your procurement needs a security questionnaire completed, write to us and we will answer it honestly and in full.

If you find a security problem, write to privacy@arborionglobal.com with enough detail to reproduce it. We will acknowledge within two working days, keep you informed, and we will not pursue anyone who reports a genuine issue in good faith and does not access data that is not theirs.