Security
Private by default. Verifiable by design.
- Data
- Encrypted in transit and at rest. Access limited to named people, under NDA.
- Scope
- Only what verification requires. Never resold.
- Cross-lender checks
- A match signal only. Never your tape.
- Retention
- Returned or deleted at the end of the engagement, as you instruct, with written confirmation.
- Hosting
- European Union, unless your agreement says otherwise.
- This website
- HTTPS only. Strict security headers. No cookies. No trackers.
- Disclosure
- Found a vulnerability? security@arxacapital.com security.txt
- Service subprocessors
- Listed in your data processing agreement.
Website and email providers
| Provider | Role | Country | Transfer safeguard | Official link |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, TLS, DNS, form function | United States | EU-US Data Privacy Framework | www.cloudflare.com opens in a new tab |
| Google Workspace (Google LLC) | Email for arxacapital.com | United States | EU-US Data Privacy Framework | policies.google.com opens in a new tab |