Security Overview - ARC by AiOC

Purpose-built for the firearms industry. ARC by AiOC employs a defense-in-depth strategy with multiple overlapping security layers to ensure your sensitive records remain protected.

10-Layer Security Architecture

Layer	Protection	Description
1	Edge Protection	Traffic filtered at network edge
2	Encrypted Transport	All data encrypted using TLS 1.3
3	Mutual Authentication	Certificate-based server-to-server auth
4	Network Isolation	Backend not directly internet-accessible
5	API Authentication	Secure token validation on all requests
6	Least Privilege	Minimum required permissions enforced
7	Data Isolation	Complete separation at database level
8	Audit Logging	Immutable record of all actions
9	Firewall Protection	Default-deny policies at all boundaries
10	Session Security	Short-lived tokens, continuous validation

Data Protection

🔐

Encrypted in Transit

TLS 1.3 encryption

💾

Encrypted at Rest

Database & storage

🇦🇺

Australian Hosted

All data in Australia

🔒

Data Isolation

Complete separation

Your Data is Completely Isolated

Row-Level Security: Database queries filtered to your shop only
Storage Segregation: Images stored in isolated buckets per shop
Access Controls: Impossible to access another dealer's records

Authentication & Access Control

Multi-Factor Authentication (MFA)

MFA is mandatory for all accounts:

✓ TOTP (Google Authenticator, Authy)
✓ WebAuthn/Passkeys (biometric)
✓ Hardware security keys (FIDO2)

Session Management

Sessions validated on every request
Automatic timeout after inactivity
Secure, HTTP-only cookies
Single logout terminates all sessions

Audit & Compliance

Comprehensive Audit Logging

Field	Description
WHO	User who performed the action
WHAT	Action (upload, search, delete, etc.)
WHEN	Timestamp
WHERE	IP address and session info
DATA	Full snapshot of affected records

Audit Log Protection

Logs are immutable — cannot be modified or deleted
Retained for minimum 7 years
Available for compliance audits upon request

Compliance Alignment

✓ Australian Privacy Act 1988
✓ Australian Privacy Principles (APPs)
✓ PCI DSS (via Stripe for payments)
✓ QPS Weapons Act 1990 record-keeping

Your Role in Security

Security is a shared responsibility:

Enable MFA — Required for all accounts
Use Strong Passwords — Unique and complex
Keep Credentials Private — Never share logins
Report Suspicious Activity — Contact us immediately
Secure Your Devices — Keep systems updated

Contact

Security enquiries: [email protected]
General support: [email protected]

← Return Home