Security

The ArboStar platform is hosted on Amazon Web Services (AWS) in five regions: US West (Oregon) and US East (Ohio) in the United States, Canada (Central), Europe (London) and Asia Pacific (Sydney). Each company's account is hosted in one of these regions; we confirm which one applies to your account on request.

US West (Oregon) US East (Ohio) Canada (Central) Europe (London) Asia Pacific (Sydney)

If your company connects an accounting integration (QuickBooks, Xero, Sage or Fortnox), the clients, invoices, estimates and payments synced to it also pass through our accounting sync service, which runs in US West (Oregon).

The ArboStar Hub, our billing and contract portal, runs on AWS in the US West (Oregon) region in the United States.

Customers share the same platform infrastructure. Each customer's data is tied to its own company account, and the application limits every user to the data of the account they belong to. Dedicated hosting is not part of the standard service.

Physical security of the servers is AWS's responsibility under AWS's own certifications. Those certifications cover the infrastructure, not ArboStar; see Certifications and external assessment for what ArboStar itself holds.

About the 2025 assessment

The assessment measured our controls against the CIS Critical Security Controls v8.1. It covered all 18 control groups and focused on the safeguards CIS sets for Implementation Groups 1 and 2: essential cyber hygiene and enhanced protection. It also covered cyber risk management and incident response, and it estimated risk with the FAIR method.

The assessor reviewed our documentation and interviewed people from our infrastructure and site reliability engineering, HR and senior leadership teams, and drew on the information-sector findings of the 2024 Verizon Data Breach Investigations Report for context.

Working from our documentation and interviews, without technical testing, the assessor recorded these controls as in place at the time:

• Continuous monitoring of system health and network activity, with automated alerts sent to engineers in real time.
• Automated vulnerability scanning.
• Application logging and telemetry that track how our applications behave.
• Centrally managed access, with least privilege enforced consistently.
• Tracking of our infrastructure and cloud service assets.
• Encryption on all critical systems.
• A documented incident response plan.
• Security responsibilities clearly assigned within the infrastructure and engineering teams.
• Defined onboarding and access-provisioning workflows, with training.
• Background checks for staff with access to production environments.

HTTPS connections to the platform use TLS 1.2 or TLS 1.3, and our web servers do not accept older versions of TLS. The mobile app uses the same encrypted connections.

Production data on our servers is encrypted at rest using AWS encryption: the databases, uploaded photos and files, and backups.

Signed contract documents held in the Hub are stored in private, versioned storage, encrypted with AES-256. Integration tokens the Hub holds for other services are encrypted with AES-256-GCM, and its infrastructure secrets are kept in AWS Secrets Manager.

• Platform: databases are backed up automatically every day, and each backup is kept for 30 days.
• Hub: database backups are taken every day and kept for 7 days.

Hub backups are encrypted and kept in US West (Oregon), the same region as the Hub database. Platform backups are encrypted and kept in AWS; we confirm the region for your account on request.

After a major failure of the platform we aim to have it running again within 8 hours and to lose no more than 24 hours of data.

We have not yet run a recorded restore test of the Hub's backups, and platform restore tests are not yet on a published schedule. We will publish the date of the latest restore test here once one has run.

Inside your company

Platform users are either support (office) users or field users, and any user can be given admin rights. Admins set what each user can see and do, user by user, in the Permissions section of the user profile:

• Permissions cover clients and projects, scheduling, the mobile app, HR and payroll, and reports.
• For clients, projects and equipment, an admin can give a user full access, access to their own records only, or no access.
• Admins can hide client contact details from field staff and limit the mobile app to the current day's jobs.

When someone leaves, their user is set to inactive or dismissed rather than deleted, so the record of what they did stays intact.

Admins can see each user's login history (date, time and IP address) under Business Intelligence, Personnel, Users Login Activity.

ArboStar staff

ArboStar staff access customer data to provide support and to keep the service running. Staff access is managed centrally and limited to the roles that need it, and background checks are done for staff with access to production environments.

Passwords and sessions

• Platform: web sessions end after 2 hours of inactivity. After repeated failed sign-in attempts from the same browser and network address, further attempts must pass a CAPTCHA.
• Hub: passwords are stored hashed with Argon2id, sessions expire after 1 hour, and sign-in is rate-limited per account and per IP address.

Multi-factor authentication

Multi-factor authentication (MFA) can be switched on in the user profile, by the user or by an admin. When it is on, a six-digit code is sent by email or SMS at sign-in from a device that is not trusted. Each code expires after 30 minutes. A user can mark a device as trusted for 30 days; trusted devices are withdrawn when the password changes, and a user can sign out their other devices.

On the mobile app, Face ID, Touch ID or fingerprint sign-in can replace the password and code on that device.

Today MFA is turned on per user. Company-wide enforcement, so that an admin can require it for every user, is on our roadmap.

Your clients' portal

Your own clients sign in to their customer portal without a password. They receive a one-time code or a sign-in link by email, or a six-digit one-time code by SMS. A direct portal link sent from a client's profile works once and expires after 15 minutes.

API keys

API access uses a company API key that an admin creates under Company Management, API Access Management, and sends with each request over HTTPS. The API limits the number of requests per minute. An admin can regenerate the key at any time.

The platform records each login with the user's name, date, time and IP address, and admins can review and filter these by user. The platform also keeps a history of changes to records such as clients, estimates and invoices, so managers can see who changed what and when. Change-history entries are kept for at least 12 months. Admins can ask us for an export of the log.

In the Hub, the audit log is protected by a database control that blocks edits and deletes in normal operation, and entries are kept indefinitely, as set out in our Privacy Policy.

• Hub: every build runs an automated check of its software dependencies for known vulnerabilities. The Hub sends HTTP security headers (HSTS, a content security policy, and frame and referrer restrictions), uses secure, same-site session cookies, and checks the signature on every payment notification it receives from Authorize.net before acting on it.
• arbostar.com: sends HSTS and frame, content-type and referrer restrictions.
• Platform: sends content-type and referrer restrictions and uses same-site session cookies; it does not yet send HSTS.

The platform is monitored with automated health checks that alert our engineers. Support is available 24/7; if the platform is down for all your users, we aim to reply within 5 minutes at any time of day (see our Service terms).

We have an incident response plan. If we confirm an incident that affects your data, we email your account owner without undue delay, and within 72 hours of confirming it. Some customer contracts set shorter periods, and those apply instead.

If we become aware of a personal data breach affecting data we process for you, we notify you without undue delay and give you the information you need for your own notifications to regulators and to the people affected. Where the law requires ArboStar itself to notify a regulator, we do so.

For data about your own clients, you are the controller and ArboStar is the processor. We process it as your processor under our Data Processing Agreement, available on request from info@arbostar.com. We do not sell the personal data we process for you.

We comply with Canada's federal privacy law (PIPEDA), Canada's Anti-Spam Legislation (CASL) and Quebec's Law 25. For transfers from the EEA and the UK we rely on Canada's adequacy status, on the EU-US Data Privacy Framework where a US provider is certified, and on Standard Contractual Clauses otherwise. Details are in our Privacy Policy.

Your data belongs to you. You can export lists such as users, clients, estimates and invoices from the platform as CSV files at any time. You can also ask us for a full export of your data, including attachments, and we deliver it within 30 days of your request.

When you close your account, you can ask for an export for 30 days; after that, your data is deleted and backup copies overwritten on the timeline in our Privacy Policy, which also covers the e-signature and saved-card steps. The same timeline applies to the data you hold about your own clients in the platform.

Your card payments for ArboStar subscriptions run through Authorize.net's hosted payment fields, so the card number goes to Authorize.net and not to ArboStar; we keep a token and the last four digits.

Card payments you take from your own clients inside the platform are handled by the payment processor your company has connected. With some processors the card is entered in the processor's own hosted fields; with others the card details pass through ArboStar's servers on their way to the processor. The platform keeps the processor's token or reference and the last four digits for later use. ArboStar holds no PCI DSS attestation of its own.

For companies using Authorize.net, the platform lets you configure Authorize.net's fraud-detection filters.

As of 6 October 2026, these are the companies ArboStar itself uses to hold or transmit customer data. Services your company connects to its own account, such as your payment processor or your accounting or payroll software, receive data under your agreement with that provider. The same list, as a document, is available on request from info@arbostar.com.

The marketing, sales and accounting tools ArboStar itself uses, such as Pipedrive and QuickBooks Online, are listed in our Privacy Policy. We give customers at least 30 days' notice by email before a new company starts processing their data.

We aim to answer a standard security questionnaire within 10 business days; we confirm receipt and tell you when to expect the reply.

Questionnaires and due diligence

info@arbostar.com

Vulnerability reports

security@arbostar.com

General support

support@arbostar.com

Available on request

• Our Data Processing Agreement.
• Our subprocessor list.
• An executive summary of the 2025 risk assessment, under NDA.
• A certificate of insurance.