This page describes how ArbiBase, LLC ("ArbiBase", "we") protects the ArbiBase website at arbibase.com, the ArbiBase app at app.arbibase.com, and the systems behind them. It also explains how to report a security problem to us and what you can expect when you do.
How we collect and use personal information is covered in our Privacy Policy. Nothing on this page changes our Terms of Service, except where § 07 says so.
These are the safeguards in place today:
- Row-level security on every table. The app's database runs on Supabase (Postgres). Every table has row-level security turned on, with access policies that limit which rows each signed-in account can read or change. Staff-only areas of the app are gated separately.
- Rate limiting. Public form submissions and many of our API endpoints limit how many requests can come from one source in a short period, which slows down spam, scraping and password-guessing.
- Encrypted integration tokens. When a team member connects an outside account to our internal tools (for example, a work email account), the access tokens are encrypted with AES-256-GCM before they are stored.
- Signed links. Links that act on your behalf without a password, such as owner consent links and email unsubscribe links, carry a signed token so they can't be guessed or altered.
- Optional two-factor sign-in. Accounts can add an authenticator-app code (TOTP) as a second step at sign-in. It is optional, and we recommend turning it on.
- HTTPS everywhere. Our website and app use HTTPS, so data is encrypted with TLS between your browser and our servers. The app also tells browsers to always use HTTPS for it.
- Role-based staff access. ArbiBase staff see only what their role needs. Our internal tools separate teams such as sourcing, acquisitions, sales, marketing and regulations, and administrative areas are restricted to administrators.
- Error monitoring. We use Sentry to alert us to errors and performance problems in the app so we can find and fix faults quickly. Session replay is turned off.
No set of safeguards removes all risk. We keep improving these measures as we find gaps, and we would rather hear about a weakness from you than from an attacker.
All card payments for subscriptions, property unlocks and concierge sourcing are handled by Stripe. You enter your card details on Stripe's checkout and billing pages, and Stripe stores them. ArbiBase never receives or stores your full card number or security code. We see only what Stripe shares with us to run your account, such as the payment status, amount, and the card brand and last four digits.
Referral partners who receive payouts are paid through Stripe Connect, and their bank details are held by Stripe, not by us.
We want this page to be accurate, so here is what we do not have:
- We do not hold any security certification or attestation (such as SOC 2 or ISO 27001).
- We do not run scheduled third-party security audits or penetration tests.
- We do not offer a paid bug bounty.
If that changes, we will update this page.
If you think you have found a security problem in ArbiBase, email [email protected]. Please include:
- A short description of the problem and what an attacker could do with it.
- The page, URL or API endpoint affected.
- Step-by-step instructions to reproduce it, plus any screenshots, requests or proof-of-concept code.
- The account you used for testing, if any, and the date and time you tested.
- How you would like us to contact you.
Please don't include other people's personal information in your report beyond what is needed to show the problem.
When you look for or test a vulnerability, please:
- Test only with accounts you own or have the account holder's permission to use.
- Don't view, copy, change or delete data that isn't yours. If you reach someone else's data by accident, stop, don't keep a copy, and tell us in your report.
- Do only what is needed to show the problem exists. Don't move further into our systems once you have confirmed it.
- Don't disrupt the service: no denial-of-service testing, no high-volume automated scanning, and no flooding of our forms, which reach real staff and real property owners.
- Don't contact, trick or pressure our staff, customers or property owners, and don't attempt physical access to any location.
- Don't ask for payment in return for not disclosing a problem.
- Follow the law that applies to you.
If you make a good-faith effort to follow § 05 and § 06, we will treat your research as authorized. We will not bring legal action against you or ask law enforcement to act against you because of it. For research that follows this page, we waive the parts of our Terms of Service that would otherwise prohibit probing or testing the platform.
This promise covers ArbiBase only. We can't give permission on behalf of the outside services we use (see § 08). If someone else brings a claim over research you did in line with this page, we will confirm, if asked, that your research was authorized by us.
If you aren't sure whether something is allowed, email [email protected] and ask before you test.
In scope
- arbibase.com and its pages and forms.
- app.arbibase.com, including the operator, owner, concierge-client and referral-partner areas.
- The ArbiBase APIs those sites call.
- How we have configured the services we use, for example a database access rule we set up incorrectly.
Out of scope
- Weaknesses in the services themselves that we rely on, such as Stripe, Supabase, Amazon Web Services, Google, Hostinger, Twilio or Resend. Please report those to the provider.
- Denial-of-service, load or stress testing.
- Social engineering, phishing of our staff or users, and physical attacks.
- Reports from automated scanners with no working proof that the issue can be exploited.
- Missing security headers or best-practice settings, with no demonstrated impact.
- Problems that need a compromised device, or that only affect the person running them (such as self-XSS).
- Issues we already know about or that someone else has already reported.
Spam or phishing messages that pretend to be from ArbiBase aren't vulnerabilities, but we still want to know: forward them to [email protected].
We are a small team, and we read every report. Here is what to expect:
- We aim to acknowledge your report within 5 business days.
- We look into it, work out how serious it is, and may ask you questions.
- We fix confirmed problems, starting with the most serious. How long a fix takes depends on the problem, so we don't promise a fixed deadline, but we will keep you informed of progress.
- We tell you when the fix is in place. If you want to publish details after that, we ask you to agree a date with us first.
If we learn that personal information we hold has been accessed or disclosed without authorization, we will investigate, act to contain it, and fix the cause. We will notify affected people, and regulators where required, as required by applicable law. The notice will explain what happened, what information was involved, what we are doing about it and what you can do to protect yourself. We will normally send it by email to the address on your account.
Some protections depend on you. Please:
- Use a strong password that you don't use anywhere else, and turn on two-factor sign-in.
- Keep your login to yourself. Each account is for one person, and you are responsible for activity on it.
- Don't share your password or sign-in codes with anyone, including anyone who says they are from ArbiBase. Our staff don't need them to help you.
- Keep your devices and browser up to date, and sign out on shared computers.
- Store any data you export from ArbiBase securely, especially owner contact details from unlocked properties.
- Tell us straight away at [email protected] if you think someone else has used your account.
Security reports and questions about this page:
Please send vulnerability details by email rather than by phone, so we have a written record and can follow up.