Security

Last updated: 2026-10-23.

Arcadium Data is a small team running a data service. We do not hold a SOC 2 or ISO 27001 certification. Instead, this page says exactly how the service is hosted and protected, so you can check it against your own requirements. We answer security questionnaires on request.

Hosting

  • The API, the MCP server and the database run on a cloud server we operate at Hetzner Online in Germany (EU).
  • This website is a static site served through Cloudflare. It has no login, sets no cookies and runs no analytics.
  • Off-site copies of the database backups are stored in Cloudflare R2 object storage, encrypted at rest by the provider.
  • The current list of service providers is on the data processing addendum page (sub-processors).

Encryption in transit

  • Every public endpoint is served over HTTPS only (TLS certificates from Let’s Encrypt for the API and MCP hosts, from Cloudflare for the site).
  • The database is not reachable from the internet: it listens on the server’s local interface only.
  • Backups travel to object storage over TLS.

Access control

  • The server firewall allows SSH, HTTP and HTTPS only. Administration is over SSH with keys.
  • Code reaches the server only through the CI deploy pipeline; its deploy key can run one deploy command and nothing else (no shell, no forwarding). A deploy that fails its health checks rolls back automatically.
  • The API reads the datasets through its own database role, limited to reading the tables it serves. Internal status pages need authentication.
  • Secrets (database password, provider keys) live in the server’s environment file, never in the code repository. The database password is generated at setup.
  • Access is limited to the people who run the service.

API keys and account data

  • An API key is shown once, when it is created. We store only its SHA-256 hash and a short prefix for support, so a copy of the database does not reveal usable keys.
  • Keys can be revoked at any time; trial keys expire on their own.
  • Per account we keep a business email, the company domain, the plan and daily call counts per route. Watchlists hold company domains. Nothing else about you is needed to use the API.
  • The datasets themselves hold no personal data: names, emails and phone numbers are removed before anything is stored.

Backups and recovery

  • The database is dumped every night, per schema. Three nightly and four weekly dump sets are kept, on the server and off-site.
  • A restore test runs on a schedule, and a dump is taken before every database migration.
  • Scheduled jobs report to a monitor that alerts us when a job, a backup or a restore test fails or does not run, and when disk space runs low.

Report a security issue

Write to [email protected]. Please include what you found, where, and how to reproduce it. We confirm receipt within two business days and keep you posted until it is fixed. Please do not run tests that degrade the service for others or access data that is not yours. We have no bug bounty programme.

If an incident affects your account data, we tell you without undue delay, and within the 72 hours GDPR sets where it applies, with what happened, what data was involved and what we did. The same address is published in security.txt.