When you authenticate with Arcus Security Gateway via Google or GitHub OAuth, we collect basic profile information including your email address and name. We do not collect or store your passwords.
The information we collect is strictly used for authentication and ensuring tenant isolation across workspaces. Your data ensures that your API keys, transfer logs, and policy controls remain securely within your organization's environment. We do not sell your personal data to third parties.
For any privacy-related questions or data deletion requests, please contact our support team at arcussupport@gmail.com.
Delivering the protection you are paying for requires us to read the content of every message your agents dispatch. The body of each payload is inspected against your own policies, parameter guardrails, and the sensitive-data scanner before it is forwarded, and a match may hold or refuse the message outright. This processing happens at the gateway so that a live credential in an outbound payload never leaves your perimeter. We do not use your payload content for model training, advertising, or any purpose other than evaluating and recording that dispatch.
Each dispatch is recorded with the metadata needed to explain a decision: your agent identifier, the destination host, payload size, attempt count, HTTP status, any error, the key prefix used, and the timestamp. Where a guardrail matched, the specific fields that tripped and the values observed are recorded too, so a rule can be tuned rather than guessed at. These records are written to a hash chain — they can be read and cryptographically verified, but not altered or removed. Retention is bounded by your plan and the window is shown in the workspace, after which records age out.
Your workspace is the unit of isolation: agent identifiers, keys, logs, policies, and guardrail baselines are namespaced per tenant, so a like-named agent in another account is never treated as the same one. Authentication and billing are handled by our processors — Google or GitHub for sign-in, and Polar for subscription payments — and each receives only what it needs to perform that function. Your payment details are entered with Polar and never reach our servers. We do not sell your personal data, and we do not share workspace content with third parties for their own purposes.
You can revoke any API key and delete your transfer logs from the workspace at any time, and deleting your account removes the workspace and everything scoped to it, subject only to records we are required to retain for abuse investigation. API keys are stored hashed and shown to you in full exactly once, at creation. Workspace access is authenticated per request, and every administrative action is attributed to a named actor in the audit chain. To request deletion of your account or of any held payload, write to arcussupport@gmail.com from the address on the account.