Arcane
SECURITY POSTURE

We treat your agents like we'd treat ours.

Deployment model, secrets handling, evidence integrity, and what we commit to today.

Tenets

Four invariants the platform holds, always.

DEPLOYMENT

VPC-native enforcement

Arcane runs in your account. Policy evaluation, token mint, and audit emission stay inside your perimeter — never round-trip through ours.

SECRETS

No standing access

Tokens are short-lived and task-bound. The control plane never persists long-lived credentials for your downstream services.

EVIDENCE

Signed, chained, exportable

Every decision is a signed, chained record. Evidence is exportable in the formats your reviewer accepts — including the controls your specific audit cares about.

POSTURE

Defense in depth

Identity binding, contextual policy, and per-call enforcement layered together. Failure of any single layer doesn't yield standing access.

Commitments

What we commit to today.

No theatrical framework badges. Specific, verifiable claims — paired with evidence on request.

  • Tenant isolation
    VPC-native, single-tenant
  • Secrets handling
    No long-lived credentials stored
  • Evidence integrity
    Signed + chained decision log
  • Audit support
    Evidence packs on request