Security

Arciin is local-first. The goal is that your libraries, credentials, and AI traffic stay on infrastructure you operate. Our marketing site and license service are separate from the data plane of your instance.

On a typical self-hosted deploy:

Only what you configure: outbound calls to AI providers you choose, optional remote access (your reverse proxy or tunnel), optional backup destinations, and periodic license checks for paid plans. We do not need your file contents to sell you a license.

Arciin supports local authentication and, on higher plans, multi-user roles. You should place the instance behind TLS when exposed beyond a trusted LAN, restrict admin accounts, and rotate API keys. Business plans may include SSO and advanced access policies as documented at purchase time.

Use HTTPS for any remote access path. At-rest encryption depends on your disk and volume setup. Paid vault features encrypt secrets within the application; you still control the host’s full-disk encryption.

Free tier uses manual updates; paid plans can automate updates. Apply security patches on the OS, reverse proxy, and container runtime you use to run Arciin.

If you believe you found a security issue in Arciin or this website, email sales@arciin.app with details and steps to reproduce. Please give us a reasonable window to respond before public disclosure.

Self-hosting shifts operational security to you. We provide software and guidance; we cannot guarantee that every deployment will be free of misconfiguration or compromise.