Security
Security at ARVOB
Your business runs on this data, so we protect it seriously. Here's how ARVOB handles encryption, access control, tenant isolation and hosting — described plainly, without the marketing gloss.
- Encrypted in transit (HTTPS/TLS) and at rest
- Each organisation's data isolated by row-level security
- Authenticated access with multi-factor on production systems
- Hosted on trusted, audited infrastructure
Encryption
All traffic between your devices and ARVOB is encrypted with HTTPS/TLS, and your data is encrypted at rest in our backend storage. That covers the business records you enter as well as the job photos and receipts your crew captures.
Tenant isolation and access control
ARVOB is multi-tenant, and every business's data is isolated at the database level. Access is governed by row-level security tied to your organisation's membership, so one organisation can never read another's records. Inside your organisation, what each person sees is governed by their role — and money is masked from field roles by default.
Row-level security
Every business table is protected by a policy that checks organisation membership before any read or write — enforced by the database, not just the app.
Role-based visibility
Owners, office staff and field crews each see what their role allows. Pricing and margins stay with the office by default.
Authenticated by default
Accounts are protected by our authentication provider, and access to production systems is restricted and protected with multi-factor authentication.
Hosting and infrastructure
ARVOB runs on a small, deliberate set of trusted providers: Supabase for database, authentication and file storage, and Vercel for application hosting and content delivery. These providers offer strong, audited security controls, and access to production is restricted and logged.
Backups and reliability
Your data is backed up as part of our normal operations so it can be recovered. When you delete data inside ARVOB, it's removed from active systems and then purged from backups according to our backup rotation.
Responsible disclosure
No system is perfectly secure, and we welcome help keeping ARVOB safe. If you believe you've found a security issue, please email security@arvob.com with the details and we'll work with you to investigate and resolve it. Please give us a reasonable chance to fix an issue before disclosing it publicly.
Frequently asked questions
01Is my data encrypted?+
Yes. Traffic is encrypted in transit with HTTPS/TLS and your data is encrypted at rest in our backend storage.
02Can another business using ARVOB see my data?+
No. Every organisation's data is isolated at the database level with row-level security tied to your membership, so no other organisation can read your records.
03Where is ARVOB hosted?+
On trusted infrastructure providers — Supabase for database, auth and storage, and Vercel for hosting and delivery — with restricted, logged access to production.
04How do I report a security issue?+
Email security@arvob.com with the details. We'll investigate and work with you to resolve it, and we ask for a reasonable window to fix issues before public disclosure.
Keep exploring
Ready when you are
Security you don't have to think about
Start a free trial and put your business on infrastructure built to protect it.