Security

Every workspace is walled off

Access rules live in the database itself, not only in the app's screens. Each query is checked against the workspace you belong to and your role in it. An agency can't read another agency's data, and a client login can only read content that belongs to that client.

Roles inside your agency

Owners and admins manage the workspace. Team members see internal work. Clients see their own company's content and nothing else. Access to stored client credentials can be limited to specific people.

Encryption

• All traffic between your browser and Ark Agency is encrypted with HTTPS.
• Client logins you store in the vault are encrypted with AES-256-GCM on our server before they reach the database, using a key that's kept separate from the database.
• The key that links your Google Calendar is encrypted the same way, with its own separate key.
• Passwords are never stored in readable form. Our sign-in provider stores only a hash.

Infrastructure

Ark Agency runs on established cloud providers for hosting, database and file storage. They run the physical security, network protection and backups for their platforms. The full list is in our subprocessors.

What you can do

• Use a password you don't use anywhere else.
• Only invite people who need access, and remove them when they leave.
• Ask your clients to keep two-factor authentication on for the accounts you manage.
• Give vault access only to the people who post for that client.

Reporting a problem

If you think you've found a security issue, email support@ark-agency.app with the details and steps to reproduce it. We'll reply within two working days and keep you updated while we fix it. Please don't access other people's data or disrupt the service while testing. Good-faith reports are always welcome.