Legal
Security
How Arqemate approaches tenant isolation, access control, and operational safeguards.
Last updated 2026-11-01
01
Tenant isolation
Application queries are scoped by tenantId. Cross-tenant project access is denied in service code and covered by automated isolation tests.
02
Authentication and authorization
Better Auth powers email/password sessions. Permissions are evaluated at runtime with RBAC. Suspended tenants cannot write; platform support requires an explicit timed grant.
03
Transport and secrets
Production traffic should terminate TLS at your edge. Secrets (auth, database, Razorpay, Resend) stay in environment configuration—never in the repository.
04
Assurance requests
This page summarizes product security design. For procurement reviews, request a security questionnaire via Contact.