Trust Center
Trust without theatre.
See how Arrota establishes source, evidence, status and history, protects private records, uses AI within defined boundaries, and documents the controls behind the platform.
How trust works
Four questions every record should answer.
Source
Who created the record?
The organisation behind the record and its associated identity.
Evidence
What supports it?
Issuer assertions, recorded signatures and relevant confirmation signals.
Status
Does it still stand?
Active, expired, revoked, superseded, under review or pending claim.
History
What changed?
Lifecycle events remain attached instead of being overwritten.
Record states
Six states. Clear meaning.
The word travels with the state, so meaning never depends on colour alone.
Signature & provenance
What a recorded signature means.
A cryptographic signature is recorded when the issuer creates the record. It anchors the origin and content of that issued version.
Later changes are represented through the record’s status and history. A signature helps show origin and integrity within Arrota’s signing system; it does not independently prove that every real-world fact behind the record is correct, and Arrota does not present it as a universal truth claim.
- Source
- Northstar University
- Signature
- Recorded at issuance
- What it anchors
- Origin + content at issue time
- What it is not
- A live re-check on every visit
Product preview · Demo
Privacy & visibility
Visibility is part of trust.
Public record
Shows the credential type, issuer, status and relevant public fields. It does not expose the holder’s complete private record.
Private share
Contains only the records and fields the holder selected, for as long as they allow.
Holder control
Private records do not become public just because another record is public.
Formal verification
Structured information is returned through an authorised verification process, according to the applicable disclosure rules.
Public verification ≠ private sharing ≠ formal verification.
Knowing a credential’s public identifier does not grant access to private records, fields or documents.
Security controls
Controls behind the platform.
Each control below corresponds to implemented behaviour in the product. Deeper technical detail lives on the Security page.
Identity & access
- Password controls with lockout protection
- Multi-factor authentication
- Session management and re-authentication for sensitive actions
- Issuer review before activation
- Role-based organisation and admin access
Data protection
- Private object storage; files are never public URLs
- Short-lived signed download links
- TLS for data in transit
- Row-level database security
- Signing keys stored encrypted; share tokens held as hashes
Record integrity
- SHA-256 fingerprints recorded for documents
- Digital signatures recorded at issuance
- Corrections, supersessions and revocations kept in history
- Lifecycle state visible on the record
- Attributed, dated audit trail
Operational security
- Rate limiting on authentication and public surfaces
- Error and reliability monitoring
- Background job delivery with signed payloads
- Dedicated route for security reports, separate from support
Verification privacy
- Holder authorisation before private information moves
- Field-level verification outcomes
- Minimum disclosure by default
- Private records are not exposed to verifiers directly
AI controls
- Consent gating before AI processing runs
- Defined processing purposes only
- Issuer confirmation stays separate from AI checking
- Uncertain results stay labelled, never promoted to issuer truth
- Minors excluded from unsupported AI processing
Responsible AI
AI can help read evidence. It does not decide what is true about a person.
Where AI helps
- Extracting supported text from documents a holder uploads
- Identifying likely fields such as dates, titles and organisations
- Structuring information for a person to review
- Assisting classification or normalisation
Where AI stops
- ExcludedDeciding whether a credential is genuine
- ExcludedTurning holder-uploaded evidence into issuer-confirmed proof
- ExcludedScoring a person’s trustworthiness, employability, talent or character
- ExcludedInferring unrelated facts about a person
- ExcludedReplacing issuer confirmation
High-confidence extraction may assist workflow processing. Uncertain results remain labelled and reviewable. Issuer confirmation is a separate trust event performed by the issuing organisation.
Trust boundaries
What Arrota does not claim.
- Issuer facts
- Arrota shows who issued or confirmed a record. The organisation remains responsible for the facts it asserts.
- Judgment of the person
- Arrota does not rank character, ability, credibility or employability.
- AI authority
- AI may assist with processing, but it does not replace the organisation as the source of an issuer-backed record.
- Recorded signatures
- A signature helps show what was issued and by whom in the system. It does not independently prove that every underlying real-world fact is correct.
Subprocessors
Who processes what.
The providers below are part of the current production architecture. The Privacy Notice is the authoritative description of how each one is used.
Supabase
Authentication, Postgres database, private file storage, signed download links.
Account data, records, documents
Private storage; files are never public URLs
Vercel
Application hosting, serverless execution, scheduled processing.
Application traffic and runtime data
—
Mistral AI
Consent-gated OCR, name matching, structured extraction, Copilot and résumé features.
Document bytes and career context, only after holder consent
Holder name, email, phone and date of birth are not added to career prompts
Google Cloud Vertex AI
Search-grounded prompts; fallback when Mistral is unavailable.
Prompt content for grounded requests
Google states grounded data is retained 30 days; no training on customer data without permission
VirusTotal
Malware checking of uploaded files.
A SHA-256 hash only; never file bytes, names or content
Uploads fail closed if scanning is unavailable or suspicious
Upstash
Redis-backed rate limits and QStash job delivery.
Rate-limit keys; opaque job identifiers
QStash never receives emails, passwords, documents or profile data
Resend
Transactional email delivery.
Email address, template content, delivery metadata
—
Sentry
Error and reliability monitoring.
Error reports with pseudonymous context where needed
—
Regional hosting and transfer details are described in the Privacy Notice. Arrota does not sell personal data or share it for cross-context behavioural advertising.
Assurance & compliance
Assurance without decoration.
Arrota publishes certifications and formal attestations only when they are genuinely held. Nothing on this page is a badge we cannot support.
Independent security testing
Security testing and remediation are part of production readiness. Findings are triaged and fixed before release.
Production security review
Issues identified through security review are tracked and remediated before being represented as resolved.
Compliance certifications
Formal certifications (such as SOC 2 or ISO 27001) will be published here when completed and supportable. None are claimed today.
Security documentation
Procurement and security-review materials will appear here as they become final and auditable.
Trust Center updates.
Material changes to Arrota’s security controls, subprocessors, AI practices and assurance status will be published here.
Resources
Go deeper.
Security concerns: email security@arrota.com. Reports use a dedicated route, separate from sales and product support.
Ask the hard question.
If your security, legal or procurement review needs evidence Arrota cannot yet provide, we would rather tell you directly.