Arkon GroupTrust & Privacy

Your data, and what we never do.

Plain language, operator-controlled defaults, and every claim mapped to a verifiable infrastructure choice.

Last reviewed: 2026-10-10

01

Your data lives in the EU, for European and US customers alike. Download it yourself at any time; ask us and we remove it.

Data residency: Production application is deployed to Vercel EU regions; the Postgres database and object storage are provisioned on a Supabase EU project. No customer audit data leaves the EU at rest. (Model inference traffic is documented in Section 02.)
US customers: The servers stay in the EU. A US company’s audit and engagement data is held on the same EU infrastructure under the same controls; we do not run a US region today and say so rather than imply one. US public-company evidence (SEC filings, Census, BLS, BEA) is read from its public sources, not stored as customer data.
Processor obligations: We act as processor for personal data submitted through the audit or the platform. A Data Processing Addendum is available on request; the same terms apply to free-audit usage.
Right to deletion (Art. 17): To delete your organisation’s data (engagements, audit data, findings, uploaded files and the records tied to them), email hello@arkonconsultinggroup.com from the address on your account. We confirm by email when the deletion is done.
Right of access & portability (Art. 15, 20): Download all of your organisation’s data yourself, at any time, with Download my data in the app’s privacy settings: one machine-readable file. See Section 06 below.
Lawful basis: Free-audit processing relies on consent (you start it). Paid-plan processing relies on contract. Telemetry relies on legitimate interest, scoped to platform health and abuse prevention; never sold, never used to train models.

02

Model-training disclosure.

Your audit answers are not used to train any model.

The honest substance behind that line — not a marketing slogan:

How prompts are processed: When the platform needs synthesis, the relevant inputs go to Anthropic’s API as prompts and the output comes back. We persist input and output in our own database for product functionality.
No model fine-tuning on customer data: We run no fine-tuning, RLHF or distillation on customer audit data, and export no prompts to a training dataset. The same holds for Arkon’s reasoning inside the platform.
Anthropic’s side of the boundary: Anthropic processes prompts as an API provider under their commercial terms — they do not train their foundation models on API customer data by default. Anthropic Commercial Terms and the Anthropic data-use policy cover the upstream commitment we rely on.
Data flow, end-to-end: your input → our API → Anthropic API → model output → our database → your dashboard. No third destination. No training pipeline branch.
Retention boundary: Audit prompts & outputs persist as part of your engagement. They are deleted with your organisation’s data on request, or, for a free audit never claimed by an account, after the 30 days described in Section 03.

03

Audit data lifecycle.

A free audit that is not claimed by an account is permanently deleted after 30 days.

An account keeps it: Create an account and the free audit binds to it. From then on it is part of your organisation’s data and stays for as long as you keep your account, whether or not you activate a module. It is deleted with the rest on request (Section 01).
Unclaimed audits are deleted: A free audit never claimed by an account is deleted after 30 days: answers, figures, findings and session token. A weekly sweep removes it, so it is gone within a week of day 30. Aggregate, non-identifying quality metrics are retained.
Deletion on request: Before day 30, anyone can ask for a free audit to be deleted at once by emailing hello@arkonconsultinggroup.com with the company name and the email address used for the audit.
What is not subject to the 30-day clock: Billing records, security audit logs and sub-processor logs are retained per legal/financial obligations (typically 7 years in the EU). These do not contain audit content.

04

Encryption & authentication.

Standard production posture. Where the standard isn't strong enough, we go further. Where it is, we don't theatre it up.

In transit: All HTTP traffic is TLS 1.3 (TLS 1.2 minimum, enforced at the edge). HSTS preloaded. No mixed content. Internal service-to- service calls within Vercel/Supabase use mutually-authenticated TLS.
At rest: Postgres data is encrypted with AES-256 at rest (Supabase managed). Object storage (audit transcripts, exports) is encrypted at rest with per-bucket keys. Backups are encrypted with the same key envelope.
Authentication (operator): Sign-in is handled by Clerk: email + password with TOTP MFA by default, SSO + SCIM on enterprise plans. Session cookies are httpOnly, secure, SameSite=Lax; 7-day lifetime, 24h idle expiry.
API authentication: Every authenticated platform route requires a Clerk session token, verified server-side before any data access. Anonymous free-audit routes use a short-lived per-session token, rate-limited per IP.
Secrets & access: Production secrets are scoped per environment in Vercel and Supabase. No shared production credentials. Access to production data is logged and reviewable. Engineering access uses short-lived tokens.

05

Sub-processor list.

The full list of third parties that may process customer data on our behalf. We will notify operators by email at least 30 days before adding a sub-processor that materially changes data handling.

Sub-processors that may process customer data on our behalf
Sub-processor	Purpose	Data categories	Residency	Policy
Anthropic Model inference (paraphrase, preliminary read, platform reasoning)	Model inference (paraphrase, preliminary read, platform reasoning)	Audit prompts + outputs	API provider — no model training on customer data	Policy →
Clerk Authentication, session management, MFA, SSO/SCIM	Authentication, session management, MFA, SSO/SCIM	Operator identity + session metadata	EU + US (configurable per plan)	Policy →
Supabase Postgres database + object storage	Postgres database + object storage	Engagement data, exports, audit transcripts	EU (Frankfurt) production project	Policy →
Vercel Application hosting, edge runtime, build pipeline	Application hosting, edge runtime, build pipeline	Request metadata, deployment artefacts	EU regions for production	Policy →
Stripe Subscription billing + payment processing	Subscription billing + payment processing	Billing identity, payment methods, invoices	EU (Ireland)	Policy →
Resend Transactional email delivery	Transactional email delivery	Operator email + email body	EU	Policy →

Sub-processor terms are governed by their own published policies; we contract with each on the basis of GDPR-compliant DPAs and EU data residency where the deployment supports it.

06

Data export commitments.

You own your engagement data. You can take it with you, at any time, in a format other tools can read.