ArizalArizal Trust centre
ContactSign in

Trust & safety

Security

How Arizal protects accounts, workspaces, and developer access.

Last updated 19 July 2026 support@arizal.app
Protected credentialsPasswords are hashed and third-party OAuth tokens are encrypted.
Workspace isolationMembership roles and explicit workspace scopes control data access.
Revocable developer accessAPI keys are scoped, hashed and can be revoked from Settings.
On this page
  1. 1. Authentication
  2. 2. Workspace isolation
  3. 3. API keys & MCP OAuth
  4. 4. Data protection
  5. 5. Report a vulnerability

1. Authentication

  • Email/password accounts with bcrypt password hashing.
  • Short-lived access JWTs plus httpOnly refresh cookies with rotation.
  • Optional local app lock (PIN / biometrics) on supported clients for device-level privacy.

2. Workspace isolation

Data is scoped to workspaces. Membership roles (viewer, editor, admin, owner) control who can read or change data. Public API and MCP calls require an explicit workspace id and matching scopes.

3. API keys & MCP OAuth

  • API key secrets are hashed at rest; full secret is shown once at creation.
  • Keys are scoped; revoke anytime from Settings → API & MCP.
  • MCP OAuth uses PKCE; users approve scopes on a consent screen.

4. Data protection

  • HTTPS in production.
  • Third-party OAuth tokens encrypted with AES-256-GCM.
  • Rate limiting on auth, API, and MCP routes.
  • Soft-delete trash with ~30-day retention before permanent purge.

5. Report a vulnerability

Email support@arizal.app with details. Please give us reasonable time to investigate before public disclosure.

Last updated: 19 July 2026.