ARKONOMY

AI FINANCIAL AUTOPILOT

Cybersecurity Policy

Arkonomy ("we", "our", or "us") is committed to protecting the confidentiality, integrity, and availability of user data and platform systems. This policy describes the controls we maintain to secure your information and our infrastructure.

1. Purpose and Scope

This policy applies to all Arkonomy systems, services, and infrastructure — including the web and mobile applications, backend services, third-party integrations, and any personnel or contractors with access to production systems.

The objective is to establish a consistent baseline of security controls that protects user financial data, prevents unauthorised access, and ensures continued platform availability.

2. Data Classification

All data handled by Arkonomy is classified into three tiers that govern how it is stored, accessed, and transmitted:

• Public — information intentionally available without restriction (e.g. marketing content, these policy pages). No access controls required beyond standard hosting.
• Internal — anonymised aggregates, usage metrics, and error logs used for operational purposes. Access restricted to authorised personnel. Not linked to individual identities.
• Sensitive data — email addresses, bank transaction data, savings goals, investment activity, and payment-related records. Protected through encrypted transport, provider-managed encryption at rest, row-level security, and controlled server-side access.

3. Access Control

Access to Arkonomy systems follows the principle of least privilege:

• Production access is limited to authorised accounts and protected with the security controls available on each production platform.
• Row-level security (RLS) is enforced at the database layer via Supabase — each user can only access their own records, regardless of application-layer behaviour.
• Encrypted environment variables — all API keys, secrets, and service credentials are stored as encrypted environment variables. They are never embedded in source code, client bundles, or version control.
• Server-side execution — sensitive calls to Plaid, Stripe, and Anthropic are made from server-side edge functions so provider secrets are not exposed to the client.
• Access is removed when it is no longer required.

4. Encryption

User data is protected in transit and through the controls provided by Arkonomy's infrastructure providers:

• In transit — all communication between clients and servers uses TLS 1.2 or higher. Plain HTTP connections are rejected.
• At rest — data stored in Supabase is protected by provider-managed encryption at rest and access controls.
• Session tokens — Supabase-issued tokens manage authenticated sessions and expire or rotate according to the configured authentication controls.

5. Vulnerability Management

We maintain an active programme to identify and remediate security vulnerabilities:

• Dependency auditing — automated dependency and code-security checks are configured in the source repository, with findings reviewed as part of release work.
• Dependabot — automated dependency update alerts are enabled on the GitHub repository to surface newly disclosed vulnerabilities.
• Security reviews — code changes touching authentication, data access, or third-party integrations are reviewed for security implications before deployment.
• Remediation — confirmed security findings are prioritised according to severity and practical exposure.

To report a vulnerability, please contact us at hello@arkonomy.com. We ask that you allow us reasonable time to investigate before any public disclosure.

6. Incident Response and Disaster Recovery

In the event of a security incident, we follow a structured five-step response process:

• Contain — isolate affected systems to prevent further exposure.
• Assess — determine the scope, nature, and root cause of the incident.
• Notify — inform affected users and relevant authorities as required by applicable law, without undue delay.
• Remediate — apply fixes to resolve the underlying vulnerability.
• Document — record a full post-incident report and implement controls to prevent recurrence.

Service restoration and data recovery depend on the recovery capabilities available from Arkonomy's infrastructure providers. Arkonomy does not publish a contractual recovery-time or recovery-point guarantee.

7. Physical Security

Arkonomy does not operate physical data centres. Compute, storage, and networking infrastructure is hosted by third-party cloud platforms, which manage physical access and facility security:

• Vercel hosts Arkonomy's web delivery infrastructure.
• Supabase and its infrastructure providers host Arkonomy's database, authentication, and edge-function services.

8. Vendor Risk Management

Arkonomy relies on the following service providers to operate core product features. Their own policies and security documentation govern the controls they operate:

9. Policy Review

This policy is reviewed at least annually, or following any significant security incident, major infrastructure change, or relevant regulatory development. Updated versions will be published at this URL with a revised effective date.

10. Contact

For security questions, vulnerability reports, or data security concerns, contact us at hello@arkonomy.com.

Please disclose vulnerabilities responsibly — contact us privately and allow reasonable time for investigation before any public disclosure.

---