Archwise is an early-stage, independently-run product — we don't hold formal certifications like SOC 2, and we're not going to claim otherwise. What follows is an honest, specific list of what's actually in place today.
Passwords and sessions
Sign-in, sign-up, and password storage are handled entirely by Clerk, a dedicated authentication provider — we never see or store your actual password ourselves. Every request to our servers is verified using a signed session token, checked independently on our end before anything about your account is accessed.
Your data stays yours
Every project, conversation, and architecture is scoped to your account. Access is checked on every request — another user cannot view or modify your projects by guessing a URL or an ID.
Rate limiting
Endpoints that trigger AI generation are rate-limited per account, both to keep the Service stable under load and to prevent abuse.
Browser-level protections
Archwise sets a Content Security Policy and standard security headers in production to reduce the impact of common web vulnerabilities like clickjacking and script injection.
Infrastructure
The Service runs on established third-party cloud infrastructure providers rather than self-hosted hardware, and traffic is encrypted in transit. See our Privacy Policy for more on how and where data is hosted.
Found a security issue?
We take reports seriously and will respond promptly. Please email support@archwise.app with details rather than disclosing it publicly first — we're a small, independently-run team and a direct heads-up gives us the best chance to fix it quickly.