BlogInside ARX
Controls you can see
Security a buyer cannot inspect is a promise. Here are the controls in ARX a security team can watch working, and the evidence we hand over.
This is the second of two articles written for the security teams who evaluate ARX. The first, Built to hold as little as possible, covers the architecture. This one covers the controls: the ones a reviewer can watch working during an evaluation, and the evidence we hand over afterwards.
Least privilege is a role, not a setting
Every seat in ARX carries a role, and the role decides which tools that person's assistant may call. A finance seat can raise draft bills and read the ledger. A marketing seat cannot, and no toggle on the device can change that, because the policy is enforced on the server, where the tools gateway checks every call, and mirrored on the device, so the assistant does not offer what the role does not allow. Change a role and the change propagates within a minute, with no reinstall and no restart.
Some categories sit outside every role. Billing changes, secrets, publishing, and code execution in third-party sandboxes are invisible to every seat; no role can be configured into them. A reviewer can verify this in minutes: ask a seat's assistant for something its role does not permit and watch the refusal arrive from the server, rather than from the model's goodwill.
A human at every irreversible step
The dividing line in ARX is reversibility. Financial writes are draft-only: draft invoices, draft bills, draft credit notes, each approved by a person in the company's own accounting system before anything real happens. Risky browser actions ask for in-product approval before they run. And a person can take over any automated browsing at any moment; the assistant yields the session rather than competing for it.
We put a confirm step only where an action would be hard to take back. Reads carry no approval prompt, because a confirmation that appears fifty times a day trains people to click through it. The approvals that matter stay rare enough to be read.
The audit trail
One line in the trail records the person, the connector, the tool, the time, the outcome, the latency, and a request id. One line deliberately lacks the arguments the call carried and the results it returned.
That shape does two jobs at once. It satisfies an auditor, because every action against a connected system is attributable: who touched the accounting connector, with which tool, when, and whether it succeeded. And it protects the customer, because a breach of the trail itself would expose activity metadata, never invoice contents, email bodies or customer records. The trail is evidence about behaviour, without being a second copy of the data.
Offboarding in a minute
When an administrator removes a person, the following happens. Their connected apps are revoked upstream, at the services themselves. Their gateway credential is invalidated within a minute. Their device signs out of ARX on next launch. Their access to shared company data ends with the seat. A reviewer can time this with a stopwatch during an evaluation: remove a test seat and watch its calls start failing.
Sharing without leaking
Team file sharing inside ARX assumes the file might be the leak. Files are checked for secrets on send and checked again on receipt. Key files and configuration files are refused by name. Sizes are capped. The recipient has to accept before anything lands. And files that could carry instructions to an assistant are neutralised on the way through, so a shared document cannot quietly become a prompt.
Integrity of the client
Updates are verified against cryptographic hashes and fetched only from allow-listed hosts. The AI engine is pinned, so the code that runs is the code that was reviewed. macOS builds are signed and notarized. A write guard stops the assistant from touching its own application, which means the software enforcing every control above cannot be edited by the thing it constrains.
What we hand a security team
The security pack contains an architecture overview, a data-flow table, the sub-processor list, our Data Processing Agreement with Article 28 terms, the transfer mechanisms, a Data Protection Impact Assessment template, the summary of the independent code audit, the penetration-test letter, the SOC 2 status letter, and completed SIG Lite and CAIQ answers. The security page carries the live status of each, and we quote the turnaround when you ask.
We are a small company selling to companies many times our size, and we think a vendor our size earns trust one way: by being inspectable. Controls you can watch working during the evaluation, and paper that matches what you watched. The full picture, with the status of every assurance programme, is on our security page. To start a review, write to security@imperiumos.ai.
