Security Practices

At Archil, security is foundational to our cloud filesystem platform. This page describes the technical and organizational measures we use to protect your data. We will expand this page as our security program matures and additional certifications are obtained.

Encryption

In Transit

All data transmitted between your systems and Archil is encrypted using TLS 1.2 or higher. Internal service-to-service communication is also encrypted in transit.

At Rest

All customer data stored within Archil is encrypted at rest using AES-256 encryption. Data replicated to customer-owned S3 buckets inherits the encryption configuration of those buckets.

Infrastructure

Archil offers public regions on Amazon Web Services (AWS) and Google Cloud, with additional regions available in preview. Azure is supported for private deployments; there are no public Azure regions. Active data is stored across multiple availability zones for redundancy and durability. See the region availability documentation.

Access Controls

• Access to production systems is restricted to authorized personnel and requires multi-factor authentication
• We follow the principle of least privilege for all internal access
• Access to customer data is logged and auditable
• Employee access is reviewed regularly and revoked promptly upon offboarding

Data Isolation

Customer data is logically isolated. Each customer's data is segregated and inaccessible to other customers. In bring your own bucket (BYOB) mode, data is stored in a bucket you own. In managed mode, it is stored in a bucket managed by Archil. In both modes, active data is temporarily held in Archil's storage layer, where committed writes are durable while they synchronize to object storage.

Private Deployment

Bring Your Own Cloud (BYOC) is available with no minimum data size. Full self-hosting keeps disk data inside your cloud account. With encrypted shared storage, the file system layer runs in your account and sends encrypted data to Archil's storage layer.

Availability

Archil is designed for 99.99% availability. We can sign an availability SLA for Enterprise customers; contact sales@archil.com to discuss your requirements.

Incident Response

We maintain an incident response process for identifying, investigating, and responding to security incidents. In the event of a data breach affecting your data, we will notify you in accordance with our contractual obligations and applicable law.

Vulnerability Management

We regularly scan our infrastructure and application code for vulnerabilities. Security patches for critical vulnerabilities are prioritized and applied promptly.

Security Advisories

When a vulnerability affects Archil clients or requires action from customers, we email affected customers and publish an advisory with affected versions and upgrade instructions. See all security advisories.

Responsible Disclosure

If you discover a security vulnerability in Archil, please report it to security@archil.com. We ask that you give us reasonable time to investigate and address the issue before making any public disclosure.

We pay bounties for responsibly disclosed vulnerabilities. Bounty amounts are determined based on the severity and impact of the reported issue. Please include a detailed description and reproduction steps in your report.

Questions

For security-related inquiries, contact security@archil.com.