What exists, and what does not yet.

• Tenant separation in the database

  Row-level security is forced on every member table, plus an access grant for each clinician. Another customer's member looks exactly like one that does not exist.

  Live

• Append-only audit log

  Reads and releases are recorded and cannot be edited by the application.

  Live

• Sign-in through OIDC with a second factor

  No passwords of our own. Demo sign-in runs on a local identity server.

  Live

• Signed webhooks

  HMAC-SHA256 signatures, retries, and a delivery log.

  Live

• Pseudonymous member IDs and small-count suppression

  Arc Watch, the portal for care teams, shows rows that carry a pseudonymous ID, and program aggregates hide small counts.

  Live

• Arc Assist, the optional AI question box

  Off for every customer until they turn it on, and not available for real patient data until a business associate agreement covers its use of the AI provider (Claude, by Anthropic). It sees a coded member reference and the results, never names, dates or notes typed by a clinic. It answers only about the member open on screen and does not diagnose or advise treatment. The change summaries and the chart note are built from the results without AI.

  Live

• Data retention and deletion

  Rules for how long results are kept and how a member's data is removed.

  Designed

• Per-customer encryption keys

  Separate keys for each customer's data at rest.

  Designed

• SOC 2 Type II report

  An independent audit of our controls.

  Planned

• Third-party penetration test

  An external test before any production use.

  Planned

• HIPAA business associate agreement

  Offered before any real patient data is handled.

  Planned

Everything on this site and in the demo uses synthetic data.