Data security

Where a service offers an official sign-in (OAuth), such as Google, Zoho, HubSpot and Microsoft, you connect through that service's own screen. We never see your password, and you can withdraw access at any time from that service.

Where a key or access token is needed, it is sent once over an encrypted connection and stored encrypted. After that, no screen in Archemesh shows it, including the screens our own team uses. You can only replace it or delete it. The dashboard shows the last 4 characters so you can tell keys apart.

Keys are not stored in your browser, in cookies or in any file on your computer.

When one of your tools needs to act (for example, to reply to a WhatsApp message), our engine unlocks the key it needs for that one task, uses it in memory, and does not save it anywhere else. Every time a key is unlocked, it is recorded in your security log: which key, which task, and when.

To be honest about the limits: because our system has to use your keys to run your tools, it is technically able to unlock them. What we guarantee is that no person can view them through Archemesh, that every use is recorded, and that only the engine account can unlock a key, and only for a task that belongs to you.

Every client's data is separated in the database, so one client can never read another client's records. Our team can only access your workspace when needed to support you, and those actions are recorded in an audit log.

Admin access requires two-step sign-in.

Once your setup works, we lock it so that a wrong click cannot break it. Changes go through a request from your dashboard and are made by our team.

For Meta services, the connection is made through a Meta developer app that you create and own inside your own Meta business account. You can see it, and you can switch it off at any time from Meta's own settings. We follow Meta's rules: replies only to people who contacted you, within the time Meta allows.

Data is backed up every night, encrypted, to a separate location. We monitor every tool and are alerted when something fails.

If we ever learn that your data was accessed without permission, we will tell you without undue delay, explain what happened and what we are doing about it, and meet the notification rules that apply to you.

You can export your data and delete your workspace from your dashboard settings at any time. Deleting your workspace also deletes the keys stored for it.

Email security@archemesh.com. We read every report and reply as soon as we can.