Artica handles help desks full of other people’s data, so the first protection is design: keep as little as possible, for as short a time as possible, and ask for the narrowest access that works. Everything on this page describes measures in place today. Our Privacy Policy says exactly what is stored, and our DPA commits to these measures for customer data.

• Ticket exporter, Article exporter and Format fixer don’t store content. They process one page, article or image at a time in server memory, and the file is built in your browser.
• Topic finder never stores ticket text. Uploaded files are deleted when the analysis reads them, and a daily clean-up removes any left behind. Results are AI-written summaries, checked so they don’t repeat real ticket text.
• Only the fields a task needs are sent to AI, and usage records hold counts, never content.
• Automated checks in our test suite fail the build if a database table gains a column that could hold ticket text or contact details.

• Every record and file belongs to a workspace, and every request is checked against the signed-in user’s workspace.
• Files live in a private storage bucket. Screenshots and images are served back only through Artica, to the workspace that owns them; uploads use short-lived signed links scoped to your workspace.

• In transit: TLS 1.2 or 1.3 only, with HSTS, on artica.tools and on every connection to our providers.
• At rest: the database and file storage are encrypted at rest by our providers.
• Application-level: Zendesk OAuth tokens are encrypted by Artica with AES-256-GCM before they are stored, and are never sent to your browser or logged.

• Sign-in is handled by Clerk; Artica never sees your password. You can turn on two-factor authentication.
• Zendesk access uses OAuth. Tokens are refreshed as needed, encrypted at rest, and deleted when you disconnect. Our processing service gets a fresh token per analysis and never stores it.
• Intercom, Freshdesk and Help Scout keys you paste into Article exporter are sealed (AES-256-GCM) into a session your browser holds for at most 4 hours, opened in memory per request, sent only to that platform, and never stored or logged.
• Production secrets are stored as sensitive environment variables in our host and have never been committed to source control.

• Personal data is removed from tickets before any other processing in Topic finder, and on request in Ticket exporter: patterns, context rules (signatures, greetings, quoted headers) and an open-source name-finding model running on our own processing service, with consistent placeholders.
• Format fixer replaces personal data, links and images with placeholders in your browser before the AI fix, and our server checks again.
• The Chrome extension redacts screenshots and step text in your browser before upload, for emails, card numbers, tokens, phone numbers, Social Security numbers and IBANs, including typed form values.
• Scrubbing is done as thoroughly as possible; no scrubber is perfect, so the layers overlap.

• Production access is limited to Artica’s operator.
• The admin view is read-only for customer accounts, shows email addresses masked, and never shows tickets, articles, topics or screenshots.
• Changes to customer accounts are made with scripts that confirm before acting and record every action in an audit log.
• Calls between our servers and our processing service, and incoming webhooks, are authenticated with secrets or signatures checked in constant time, against strict schemas that reject unexpected fields.

Artica runs on established providers: Vercel (hosting), Neon (database, AWS us-east-1), Cloudflare R2 (files), Modal (processing), Clerk (sign-in), Anthropic (AI) and Resend (email). Each is listed, with what it receives, on our subprocessors page. The Chrome extension asks for the narrowest permissions that work, ships all its code in the package (no remote code), and asks for site access only when you start your first recording.

The database can be restored to any point in roughly the last 6 hours. We don’t keep separate long-term backups, so deleted data is gone for good once that window passes. Files deleted from storage are not kept.

If we suspect a security incident, we contain it first (for example revoking sessions, rotating secrets, disconnecting integrations), investigate what was affected, and fix the cause. If personal data is affected, we notify affected customers without undue delay, aiming for within 72 hours, with what we know and what we’re doing, and notify authorities where the law requires. Details for customer data are in our DPA.

If you find a vulnerability in Artica, please tell us. We appreciate it.

• How to report: email hello@artica.tools with “Security” in the subject, the steps to reproduce, and the impact you see. We reply within 3 business days and keep you updated until it’s fixed.
• In scope: artica.tools and its APIs, and the Artica Chrome extension.
• Out of scope: our providers’ own systems (report to them), the Zendesk demo help centers, denial-of-service, spam, social engineering, physical attacks, and findings from automated scanners without a demonstrated impact.
• Please: test only with accounts you own, never access, change or keep other people’s data (stop and tell us if you reach any), don’t degrade the service, and give us reasonable time to fix an issue before telling anyone else.
• Safe harbour: if you follow this policy in good faith, we consider your research authorised, won’t pursue or support legal action against you for it, and will say so if anyone else does.
• No bounty: we don’t pay rewards, but we’re glad to thank you publicly if you’d like.

Our security.txt has the same contact details.