Security at Arclio

• Uploaded products are stored in private, access-controlled buckets — direct URLs are not public.
• After a completed purchase, the buyer receives a tokenized delivery link generated on the server.
• Each link is time-limited (24 hours) and capped at 5 downloads per token.
• Expired or exhausted tokens stop working automatically; a new link requires a new purchase.

• Authentication is handled by a managed identity provider that stores password hashes, not plaintext.
• Sessions use bearer tokens attached only to authenticated server calls.
• Sensitive profile fields (wallet address, plan, status) are stored in an owner-only table, separate from the public profile.
• Admin functionality is gated by an explicit role check in the database.

• Arclio does not custody cryptocurrency and never sees private keys or seed phrases.
• Buyer payments are processed by a managed crypto payment provider; Arclio receives a status callback and records the order.
• Webhook callbacks are verified before any order is marked paid or any download link is issued.
• Payout addresses are stored per creator and are only editable by the account owner.

• Row-level security is enabled on user data tables so each row is scoped to its owner.
• Public data (published product listings, creator storefronts) is exposed only through narrow views with safe columns.
• Server-side actions validate input with schemas before writing to the database.
• Service-role credentials are never shipped to the browser; privileged operations run only in server functions.
• Dependencies and configurations are periodically reviewed and updated.

• Use a strong, unique password and keep your email account secure.
• Only upload products you have the right to sell, and keep your payout wallet address up to date.
• Buyers: download purchased files promptly, since delivery links expire.

If you believe you have found a security issue, please report it privately through the support channel listed in your dashboard. Do not publicly disclose the issue until we have had a reasonable opportunity to investigate and respond.