Legal
Arche Legal
Review the policies that govern how Arche handles data, service use and security practices across the API and MCP server, for customers and developers.
Last updated: Sept. 13, 2026
Security
Security
Arche applies practical, risk-based security controls to protect customer data and maintain dependable API and MCP server operations.
- Encryption. Data is protected in transit and encrypted at rest where applicable in managed infrastructure.
- Access controls. Operational access follows least-privilege practices with key management and auditability controls.
- Monitoring. Security and reliability telemetry is monitored to detect anomalies and support incident response.
Security overview
Security at Arche is designed around protecting developer credentials, service integrity and data confidentiality while supporting deterministic data delivery.
Encryption
Arche API and MCP server traffic is encrypted in transit using modern TLS. Data is encrypted at rest where supported by underlying managed services and storage systems.
Access controls
Internal access is limited by role and business need. We apply least-privilege access principles, maintain key and secret management practices and retain audit logs to support review and investigation.
Monitoring and incident response
We maintain service and security monitoring for anomalous behavior, operational failures and potential abuse. Incident response processes are designed to triage, contain, remediate and communicate material issues in a timely manner.
Payment data
Card details are entered directly with Paddle.com Market Ltd, our merchant of record, and are never transmitted to or stored on Arche systems. Arche stores only the subscription identifiers needed to know what an organization is entitled to.
Vulnerability reporting
If you identify a potential vulnerability, email hello@protos.fi with reproduction details and impact context. Please do not perform intrusive testing against Arche systems without prior written authorization.
Subprocessors
Arche uses third-party providers for infrastructure, observability and billing operations. A subprocessors list is available on request for applicable agreements.