Data handling, privacy, and enterprise security
Your code is encrypted at rest with customer-managed AWS KMS keys and in transit over TLS 1.2 and 1.3 only. It is stored under paths partitioned by organization and project, every request is checked against the organization in the caller's signed sign-in token, and every infrastructure action is recorded in an audit trail that is write-locked for a year.
ARC keeps your code and findings, encrypted and isolated to your organization, for the life of the project, so results stay searchable while you plan and build. Deleting the project removes every stored version, its search index and its credentials together. Your code, findings and prompts are never used to train models, by ARC or by the model provider.
ARC's controls are designed to the SOC 2 Trust Services Criteria and are in place on AWS today. Our SOC 2 Type II audit is in progress; a control summary is available under NDA. We answer security questionnaires in your format.
Each task goes to the Claude model that suits it: Claude Haiku for indexing, rule extraction and chat, Claude Opus for architecture and capability maps. Hosted projects call Anthropic's API under terms that exclude training; in a private deployment ARC calls Amazon Bedrock inside your own AWS account. Code search runs on open embedding models inside ARC, so your code is not sent to a third party to be indexed.
The hosted service runs on Amazon Web Services in US East (Ohio). As a private deployment, ARC can run in a single-tenant environment, in your own AWS VPC, on-premises or as a black box.
Yes. The hosted service is multi-tenant and isolated by organization at three layers: the organization comes from your signed sign-in token, storage is partitioned by organization and project, and each project gets its own vector index. A single-tenant environment with dedicated storage and KMS keys is available as a private deployment.
A Data Processing Agreement is available, and you can ask for full deletion at any time. Data is processed in the United States; EU-only processing is available through a private deployment.
You receive comprehensive documentation including: Executive Summary (PDF), Engineering Documentation (HTML), domain model extraction, dependency graphs, and modernization specifications.
ARC skips environment files such as .env and flags credentials it finds elsewhere in your code. Those files are still read during analysis, so remove secrets before you upload and rotate any credential ARC flags.
Source, schemas and findings are kept until you delete the project. Deletion removes every stored version, the project's vector index and its model-provider credentials together. Application logs are kept for 14 to 30 days and the infrastructure audit trail for 365 days, write-locked.
Yes, as a private deployment. ARC can run in your own AWS VPC, on-premises or as a black box, so your code never leaves your account. It is $75,000 a year and is arranged with your account team on a call.