ARRAC's core operating principle is contain, never destroy. Every automated action the Platform can take is designed to be reversible — isolating a suspected threat to buy time for a human decision, rather than permanently deleting accounts, applications, or data. We apply the same discipline to how ARRAC itself accesses your environment as we ask you to apply to your own security posture.

2. Access Architecture

ARRAC connects to a Customer's Microsoft 365 tenant using a least-privilege, dual-credential model: a read-only connection used for continuous monitoring, and a separate, write-capable connection used only to execute a specific, approved containment action. The write-capable credential is not held open on a standing basis — it is used only for the duration a specific action requires. Destructive-capable permissions are excluded from what ARRAC requests by design.

During onboarding, ARRAC requests only the specific Microsoft Graph permissions its detection and containment capabilities require — not broad administrative access beyond what those functions need.

3. Encryption

Data in transit between your environment, the ARRAC Platform, and its sub-processors is encrypted using industry-standard transport encryption. Credentials and sensitive configuration values are encrypted at rest.

4. Audit & Logging

Every action ARRAC takes within your environment — whether recommended or automatically executed — is written to an immutable audit log, recording what was done, why, and when. This log is available to Customers within the Platform and is designed to resist tampering, including by ARRAC's own personnel.

5. Hosting & Infrastructure

The ARRAC Platform is hosted on dedicated infrastructure provided by a European hosting provider. Network access to the Platform's underlying infrastructure is restricted, and administrative access is limited to what is necessary for operation and support.

6. Integrations

ARRAC connects to the tools already in your stack rather than requiring a rip-and-replace. Live, supported integrations today:

SPLUNK CONNECTWISE SOPHOS CENTRAL DATTO RMM DATTO BCDR MICROSOFT SENTINEL (READ-ONLY KQL)

The Sentinel integration is read-only: ARRAC queries via KQL for correlation and evidence, and does not write back to your Sentinel workspace.

7. Personnel Access

Access to Customer Data by ARRAC personnel is limited to what is necessary to provide, maintain, and support the Platform — for example, to investigate a support request. ARRAC.IO is currently operated by a single founder; as the team grows, access will continue to be governed by the least-privilege principle described in Section 2.

8. Certifications

ARRAC is working toward relevant industry certifications as the business matures. No certification is represented as achieved unless explicitly stated otherwise on this page. We will update this page, and communicate directly with Customers, as certifications are achieved.

ISO 27001 — Information Security Management System

Certification in progress

Targeting April 2027, via a UKAS-accredited certification body (BSI or NQA).

ISO 42001 — AI Management System

Certification in progress

Targeting April 2027. Governs ARRAC's AI Autonomy Engine and all autonomous decision-making.

SOC 2 Type II

Certification track in progress

Targeting 2027. Controls documentation underway.

EU AI Act — Article 50

Compliant

AI-generated content is labelled, and an audit log of all AI outputs is maintained. See our AI Transparency Statement.

9. Responsible Disclosure

If you believe you have found a security vulnerability in the ARRAC Platform or website, we want to hear from you. Please report it to [email protected] with sufficient detail to reproduce the issue. Please do not access, modify, or exfiltrate data beyond what is necessary to demonstrate the vulnerability, and allow us reasonable time to investigate and remediate before any public disclosure. We will acknowledge genuine reports promptly and keep you informed of progress.

10. Incident Response

In the event of a security incident affecting Customer Data, ARRAC will investigate promptly, take reasonable steps to contain and remediate the issue, and notify affected Customers in accordance with the notification commitments in our Data Processing Agreement.