ARWANZAI POLICY
Security & Trust
ArwanzAI is designed around evidence minimization, customer isolation, bounded retention, controlled administrative access and a fail-closed execution boundary.
Version 0.9.0-web-policyUpdated 26/09/2026Automatic execution: NEVER
Security overview note: this page intentionally avoids naming or promising specific certifications or provider configurations until the production configuration and legal/security review are frozen.
Identity and access
Authenticated access, account separation, organization ownership, role-aware administration and controlled privileged operations are used to protect customer data and commercial records.Evidence protection
Incident evidence is encrypted in transit/at rest where supported by the deployment path, stored in private service-controlled locations, processed for the contracted investigation and retained only within bounded windows.Secrets and payment data
The service is designed not to collect customer passwords, private keys, card numbers, CVVs or bank credentials as ordinary evidence. Payment processing is intentionally kept outside the core application data model.AI boundary
AI providers receive only the bounded context needed for the designated analysis path. Automatic execution against customer environments is not provided.Audit and observability
Security-relevant and commercial-governance events are recorded so actions, document versions and entitlement transitions can be reviewed without storing raw customer evidence in governance metadata.Retention and deletion
Raw evidence and generated reports follow bounded lifecycle controls. Successful-run audit metadata may remain after report deletion so usage and entitlement history remain accountable.Incident response
Security or service incidents follow a detect → classify → contain → assess → communicate → recover → correct workflow, with facts separated from assumptions and external notification decisions reviewed against applicable law.Enterprise security disclosures
A controlled security questionnaire and trust pack can be provided for enterprise evaluation. Claims are classified as supported today, contract/configuration dependent, not provided or roadmap rather than being overstated.Assurance boundary
ArwanzAI does not claim a certification, compliance attestation or security standard unless the relevant evidence and scope are actually available and approved for publication.