Enterprise-grade security for your business documents.
Defense in depth across infrastructure, encryption, access control, and operations, with strict internal controls over who can access customer data, when, and why.
AES-256 encryption
Every file is encrypted at rest with AES-256-GCM and in transit with TLS 1.3.
EU-only data residency
Documents never leave the European Union. Two AWS regions, two separate copies.
Strict internal access
No engineer has standing access to customer documents. Every internal access is authorized, time-bound, and logged.
Granular access control
Per-user, per-document permissions with full audit logs of every view, edit, and download.
- Cloud provider
- Amazon Web Services (AWS): SOC 1, SOC 2, SOC 3, ISO 27001, ISO 27017, ISO 27018, PCI DSS Level 1.
- Data residency
- All customer documents are stored exclusively in AWS regions located within the European Union. No data leaves the EU under normal operations.
- Replication
- Every object is automatically replicated to a second, geographically separate AWS region in the EU. A region-level outage does not interrupt access.
- Durability
- 99.999999999% annual object durability on Amazon S3, the cloud-storage standard worldwide.
- Service availability
- 99.9% target uptime for the Arhivix application, monitored 24/7 with automated failover.
- Tenant isolation
- Each customer's data is logically isolated. Authorization is enforced on every request, on every document, in every API call.
Available on the Enterprise plan.
TLS 1.3 everywhere
All connections to Arhivix (web, mobile, and API) are protected with TLS 1.3. HTTP is rejected. Strict transport security (HSTS) is enforced with a long max-age.
AES-256-GCM
Every file uploaded to Arhivix is encrypted with AES-256 in Galois/Counter Mode before it is written to storage. Backups and replicas are encrypted with the same algorithm.
AWS-managed encryption
Encryption is applied automatically at the AWS S3 storage layer with AWS-managed keys. Authorization is enforced on every request, on every document, so a compromised account cannot reach data that does not belong to it.
| Role | View | Edit | Download | Share | Delete |
|---|---|---|---|---|---|
| Admin Workspace owner | |||||
| Editor Day-to-day team member | — | ||||
| Viewer Read-only access | — | — | — | — | |
| External Client / portal user | Scoped | — | Scoped | — | — |
Defaults shown. Every right can be overridden per folder or per document.
- Role-based and document-level permissions Assign roles across your organization or override permissions on a single folder or document. View, edit, download, and share are independent rights.
- Full audit log of every action Every view, edit, download, share, and permission change is recorded with user, timestamp, and IP. Logs are immutable from the customer side.
- Session management Sessions are signed, expire automatically, and can be revoked instantly. Suspicious sign-ins trigger re-authentication.
- Authentication Passwords are stored using a modern memory-hard hashing algorithm (never in plaintext). Brute-force protection and rate limiting are enforced on every login endpoint.
Upload
Encrypted client-side over TLS 1.3 the moment you hit save.
Active storage
Stored as AES-256-GCM ciphertext in the EU.
Replicated
Synced to a second EU region for region-level failover.
Retention
Kept for the period you configure (5, 10, 50 years).
Deletion
Removed from production immediately, purged from backups within 30 days.
GDPR-ready by design
EU data residency, lawful processing basis documented, data subject rights (access, rectification, erasure, portability) supported in-product.
Data Processing Agreement
A standard GDPR-compliant DPA is available on request for all paid customers. Contact us and we will counter-sign within a few business days.
Inherited certifications
Our underlying infrastructure (AWS) is independently certified against SOC 1, SOC 2, SOC 3, ISO 27001, ISO 27017, ISO 27018, and PCI DSS Level 1.
Serbian 2026 archiving law
Arhivix is built around the requirements of the new electronic archiving regulations: archive ledger, retention periods, qualified electronic signature, and e-shipping documents.
- Least privilege internally Engineering access to production is limited to a small group, time-bounded, logged, and reviewed. No engineer has standing access to customer documents.
- Reviewed change management Every change to production code goes through code review and automated tests. Deployments are auditable and can be rolled back at any time.
- 24/7 monitoring Application, infrastructure, and security telemetry are monitored continuously. On-call engineers are paged on anomalies.
- Secrets management Credentials and keys are stored in AWS Secrets Manager / KMS, rotated regularly, and never committed to source control.
Found a security issue? Tell us.
We treat security reports as a priority. If you believe you have found a vulnerability in Arhivix, please contact our security team directly (not through public channels) and give us a reasonable window to fix the issue before any public disclosure.
- Include clear reproduction steps and the affected endpoint or component.
- Do not access, modify, or delete data that does not belong to you.
- We will acknowledge your report within 2 business days and keep you updated until resolution.
PGP key available on request.
Where exactly are my documents stored?
Can Arhivix employees read my documents?
Are you SOC 2 or ISO 27001 certified?
Do you sign a Data Processing Agreement (DPA)?
What happens to my data if I delete my account?
Can I export my data and leave?
Hören Sie auf, Zeit mit der Suche nach Dokumenten zu verschwenden.
Wechseln Sie zu einer intelligenteren Dokumentenverwaltung. Unverbindlich, ohne Kreditkarte. 14 Tage kostenlos.