Security
ArkSlate handles the operational core of your business — sales, inventory, payroll data, and customer records. We build the platform so that data stays yours, stays isolated from every other business on the platform, and stays protected in transit and at rest.
Tenant isolation
ArkSlate is multi-tenant: many businesses share one platform, but no business can ever see another's data. Every tenant-scoped record carries a tenant_id, and isolation is enforced at the database layer with Postgres Row-Level Security (RLS). Access is derived from a signed token minted at login, not from anything the browser can set — so a query can only ever return rows belonging to the business you're signed into. RLS is the last line of defense beneath every application check, not a substitute for it.
Role-based access control
Within a business, permissions are granular. Owners, managers, cashiers, and accountants each see only what their role allows — a cashier can run the register without touching financial reports or team payroll. Every sensitive action is checked on the server before it runs, regardless of what the interface shows.
Encryption
- In transit: all traffic is served over HTTPS/TLS. Card entry happens on encrypted connections end to end.
- At rest: your database and file storage are encrypted at rest by our infrastructure providers.
- Application-level: highly sensitive fields — such as connected third-party API keys and protected health information for medical facilities — are additionally encrypted at the application layer before they're stored.
Payments & PCI
Card processing is handled by Stripe, a PCI-DSS Level 1 certified provider. Card numbers are entered directly into Stripe's secure fields and never touch ArkSlate's servers — we store only transaction confirmations and the metadata you need for your records. Payment webhooks are cryptographically signature-verified and processed idempotently, so a replayed or forged event can't move money or alter an order.
Authentication
Staff sign in through managed authentication with secure session handling. Customer portal access uses one-time codes sent to a verified email — no shared passwords. On supported devices, staff can unlock with biometrics. Login and sensitive endpoints are rate-limited to blunt brute-force attempts.
Audit logging
Sensitive operations are recorded to an audit trail. For medical facilities, access to protected health information is logged separately to support HIPAA accountability requirements. These logs give you — and, where applicable, your compliance team — a record of who did what and when.
Industry compliance
ArkSlate ships tools designed to support your compliance obligations: age verification and purchase-limit enforcement and state-traceability workflows for cannabis operators, and PHI encryption, access logging, and breach-record keeping for medical facilities. These tools help you meet your obligations; they don't replace your own regulatory responsibilities, and using them is not a substitute for your own legal and compliance review.
Infrastructure
ArkSlate runs on established, independently audited cloud infrastructure (our hosting and database providers maintain SOC 2 Type II attestations). Data is backed up by our database provider, and application errors are monitored so we can respond quickly. Certifications held by our providers are theirs; where we describe ArkSlate's own posture above, we describe what the platform actually does today.
Responsible disclosure
If you believe you've found a security vulnerability, we want to hear from you. Please email security@arkslate.com with details and steps to reproduce. We ask that you give us a reasonable opportunity to investigate and remediate before any public disclosure, and that you avoid accessing or modifying other customers' data. We do not pursue legal action against good-faith security research conducted under these guidelines.
Questions
Security questions, data-processing requests, or diligence for a larger deployment? Reach us at security@arkslate.com.