Legal
Security & Data Practices
Who operates this
archoverflow.com is operated by Kyle Bigart, United States (see Terms §1), currently as a small operation in private beta. We don't claim a compliance certification we don't have: there is no SOC 2 report today. We compensate with radical transparency — published policies, published subprocessors, a published retention schedule, and monthly internal compliance audits with records kept in version control.
Architecture & hosting
- Single-vendor infrastructure: everything runs on Cloudflare (Workers for compute, D1 for the database, R2 for storage and backups), primarily in the United States on Cloudflare's global edge network. No servers of our own, nothing self-hosted, nothing in an office.
- The entire platform is one codebase under version control; every production change is a traceable commit, and deploys are automated from the main branch — no manual server changes, no snowflake configuration.
Encryption
- In transit: TLS everywhere (HTTPS only, HSTS via Cloudflare).
- At rest: Cloudflare encrypts D1 and R2 storage at rest; backups are stored compressed in R2 under the same encryption.
- Secrets (API keys) live in Cloudflare Workers secrets, never in the repository.
Authentication & access control
- Passwordless sign-in: single-use magic links that expire in 15 minutes. No password database exists to breach.
- Sessions are server-side rows (revocable individually or all at once by the user), referenced by an httpOnly, Secure cookie storing only a hash-matched token. Sliding 14-day expiry.
- Every API request is authorized server-side against the session; roles and quotas are enforced in the Worker, never trusted from the client.
- Administrative access: one platform operator; all admin actions are written to an audit log with actor, action, target, and IP.
Data retention schedule
| Data | Retention |
|---|---|
| Customer content (projects, documents) | Life of the account; user deletion is immediate in live systems |
| Encrypted nightly backups | 30 days, then destroyed |
| Usage telemetry | 90 days |
| Deleted accounts | 14-day grace, then purged; anonymized tombstone + audit records remain |
| Deletion records (proof of compliance: email, handle, request time/IP, purge date) | 2 years |
| Magic-link tokens | 15-minute expiry; expired tokens swept nightly |
We hold the minimum and don't gold-plate beyond this published schedule; custom retention regimes are an enterprise-contract matter (see the DPA).
Backups & recovery
Automated nightly backups of the entire database to separate storage, 30-day retention, with a tested, documented restore procedure — the restore has actually been drilled, not just written down.
Logging & monitoring
Server-side request logs and first-party, cookie-less page analytics (hostname, path, country, status) on our own infrastructure. No third-party analytics, advertising, or tracking scripts exist anywhere on the Services. Administrative and privacy-relevant actions are audit-logged.
Incident response
Breaches affecting customer data: notification to affected customers without undue delay, within 72 hours of awareness, with facts, scope, and remediation — per DPA §7. Security reports are welcome at legal@archoverflow.com; good-faith research gets a good-faith response, and we ask for reasonable disclosure time.
Data rights
Export and deletion are self-service with published timelines — see Your data. Full account export is one click; deletion has a 14-day grace window and a hard purge.
AI
Customer content is never used to train AI models — ours or anyone's. Content reaches an AI provider only when a user invokes an AI feature, only via providers listed on the Subprocessors page under no-training API terms, and never via any provider's free tier.
Subprocessors & change notice
The complete list is public at /legal/subprocessors (currently two: Cloudflare and Resend). New subprocessors get 30 days' advance email notice to account owners before touching customer content.
Development practices
- Typed schema at every boundary; input validation on every API route; rate limits on abuse-prone endpoints; CSRF protection on all mutations.
- Automated typecheck, test, and build gates run before every deploy.
- A monthly automated compliance audit verifies this page's claims (retention constants, cookie inventory, third-party inventory) against the actual code, with records kept in version control.
Questionnaires
Happy to complete your firm's vendor security questionnaire (SIG Lite, CAIQ, or a custom form): legal@archoverflow.com. For organizational use, the Data Processing Addendum applies automatically and we'll countersign a copy on request.