Legal
Privacy
A production privacy policy must describe the actual services, processors, retention rules and legal basis in the jurisdictions where ARC operates.
Data minimization
ARC should collect only the information needed to provide the product, support accounts and fulfill lawful operational needs.
Security
Production systems should use encryption in transit, appropriate encryption at rest, least-privilege access and separation of privileged production access.
Control
Users should be able to access, export and delete eligible personal information according to applicable law and product requirements.