Security

Firebase Auth

We use Firebase Authentication as our identity provider. All users must authenticate using one of the following methods:

• Google Sign-In: Google Sign-In: OAuth 2.0 with Google as provider.
• Email/Password: Email/Password: Credentials stored with bcrypt hash (cost factor: 10).

JWT Tokens

Sessions are managed using JSON Web Tokens (JWT) signed with RS256:

Server-side verification

All API endpoints validate tokens using Firebase Admin SDK:

// Mandatory verification on each endpoint
const token = request.headers.get("Authorization")?.split("Bearer ")[1];
const decoded = await admin.auth().verifyIdToken(token);

DynamoDB

All user information is stored in Amazon DynamoDB with the following guarantees:

• At-rest encryption: At-rest encryption: AES-256 managed by AWS KMS.
• In-transit encryption: In-transit encryption: TLS 1.3 between client and server.
• User isolation: User isolation: All records include uid as partition key.
• Point-in-time recovery: Point-in-time recovery: Continuous backups with 35-day retention.

Sensitive data

The following data receives an additional encryption layer before storage:

Data retention

Data is retained according to the following policies:

• Conversations: Conversations: Indefinitely (until user deletes them).
• Audit logs: Audit logs: 90 days.
• Deleted account data: Deleted account data: 30 days (recovery period).

API Keys

Users can generate API keys for programmatic access. Security policies:

Rate limiting

We implement rate limiting to prevent abuse:

HTTPS mandatory

All HTTP requests are automatically redirected to HTTPS. Configuration:

• TLS 1.3 (fallback to TLS 1.2)
• HSTS header: max-age=31536000; includeSubDomains
• Certificates issued by Let's Encrypt
• Automatic rotation every 90 days

CORS

Cross-Origin Resource Sharing configured to allow only authorized origins:

Access-Control-Allow-Origin: https://arko.arcaelas.com
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
Access-Control-Allow-Headers: Authorization, Content-Type
Access-Control-Max-Age: 86400

Audit logs

We log the following security events:

• Authentication attempts (successful and failed)
• Creation, rotation and revocation of API keys
• Access to sensitive data (agents, conversations)
• Modifications to account configuration
• Data deletion

Each log includes:

Anomaly detection

We monitor usage patterns to detect suspicious activity:

• Failed authentication attempts: Failed authentication attempts: >5 attempts in 10 minutes results in 30-minute temporary lock.
• Unusual geographic access: Unusual geographic access: Login from new location generates email notification.
• Abnormal request volume: Abnormal request volume: Automatic activation of additional rate limiting.

Incident response

In case of detecting a security breach: