1. Our Commitment
Security is treated as a core product requirement, not an afterthought. This policy summarises the controls we apply across the Arush Automation platform and Arush Labs infrastructure.
2. Authentication & Access Control
- Firebase Authentication for account login, with support for strong password requirements.
- Role-based permissions so team members only access what their role requires.
- JWT-based session tokens for API requests.
- Planned: two-factor authentication (2FA), device management and login history for account holders.
3. Infrastructure & Data Protection
- Data stored in Firebase Firestore with encryption in transit (TLS) for all traffic between clients, our backend and third-party APIs.
- Rate limiting on public and authenticated endpoints to reduce abuse and denial-of-service risk.
- Webhook signature validation on incoming WhatsApp Cloud API and n8n webhook events.
- Secrets and API keys stored as encrypted environment variables, never committed to source control.
- Security headers and, where deployed, Cloudflare protection in front of public endpoints.
4. Monitoring & Audit Logs
Sensitive actions (billing changes, permission changes, data exports) are logged for audit purposes. We monitor for anomalous activity and abuse patterns across connected WhatsApp numbers.
5. AI & Data Isolation
Each business's Business Brain documents, conversation history and AI Memory are logically isolated per account. AI requests are scoped to the requesting account's data only.
6. Incident Response
In the event of a confirmed security incident affecting customer data, we will investigate promptly, take containment action, and notify affected customers without undue delay, consistent with applicable law.
7. Reporting a Vulnerability
If you believe you've found a security vulnerability in any Arush Labs product, please report it responsibly through our Vulnerability Disclosure Policy rather than disclosing it publicly.
8. Contact
Security questions or reports: hello@arushlabs.com.
