Security

Archyl implements multiple security measures to protect your architecture data and code analysis. This guide explains our security practices and how to configure secure access.

Data Protection

Encryption

Data Isolation

• Each organization's data is fully isolated
• No cross-organization data access
• Role-based access within organizations

Authentication Security

OAuth Integration

Archyl uses OAuth for Git provider authentication:

• No credentials stored: We never store your Git passwords
• Minimal permissions: Only repository read access requested
• Token-based: OAuth tokens with limited scope
• Revocable: Disconnect anytime from provider settings

Supported Providers

JWT Session Management

• Short-lived access tokens (24 hours)
• Secure HTTP-only cookies
• Automatic token refresh
• Session invalidation on logout

Private Repositories

Using Private Repos

Archyl fully supports private repositories:

1. OAuth authentication: Grants read-only access to your repos
2. Self-hosted providers: Use personal access tokens
3. Selective access: You choose which repos to connect

What We Access

When analyzing a repository:

• File structure and paths
• Code content (only during analysis)
• Configuration files

What We Don't Store

• Source code (only metadata and discovered architecture)
• Git credentials
• OAuth tokens are encrypted and scoped

AI Analysis Security

How AI Discovery Works

During AI-powered discovery:

1. Code is sent to the configured AI provider
2. Only code structure is analyzed
3. Results require your approval
4. No code is permanently stored

Access Control

Organization Roles

Team-Based Access

• Members are invited at the team level
• Different roles per team
• Project access controlled by team membership

API Key Permissions

• Read-only or Read-Write permissions
• Scoped to specific operations
• Expiration dates supported
• Audit trail of key usage

Compliance

Data Handling

• GDPR compliant data handling
• Data deletion on request
• Export your data anytime
• No data sold to third parties

Infrastructure

• Hosted on secure cloud infrastructure
• Regular security audits
• Automated vulnerability scanning
• Incident response procedures

Security Best Practices

For Your Organization

1. Use team-based access: Don't share credentials
2. Enable MFA: Secure your Git provider accounts
3. Rotate API keys: Change keys periodically
4. Audit access: Review team membership regularly

For AI Discovery

1. Review before approving: Check discovered elements
2. Use Ollama for sensitive code: Keep analysis local
3. Limit discovery scope: Only analyze needed paths
4. Exclude sensitive files: Configure exclusion patterns

For Sharing

1. Set expiration dates: Don't create permanent links unnecessarily
2. Review shared links: Periodically audit active shares
3. Use team access: Prefer team membership over share links for internal use

Reporting Security Issues

If you discover a security vulnerability:

1. Do not disclose publicly
2. Email security@archyl.com
3. Include detailed reproduction steps
4. We'll respond within 24 hours

Next Steps

• Team Collaboration - Configure team access
• Authentication - Secure API access
• AI Discovery - Configure AI providers