Skip to content

Security

Security

Section titled “Security”

ARROW is used to run security work, so it is held to the standard it helps you enforce. Security is part of how the platform is built, not a layer added at the end. The way you sign in, the way devices connect, and the way your data is stored were all decided with the assumption that someone will eventually try to get at them.

This page is the map. It covers the protections that apply across the whole platform, then points to the security details for each product and for the hardware itself.

Security by design

Section titled “Security by design”

A few principles run through everything ARROW does:

  • Least exposure. The parts of ARROW that touch a client network are not reachable from the public internet. Devices and their on-device tools answer only over a private VPN.
  • Least privilege. People and automation get access to what they need for the work in front of them, and nothing more. Access follows assignments and is removed when the assignment ends.
  • Assume the field is hostile. ARROW devices are meant to be dropped onto networks you do not control and, sometimes, into places you do not fully trust. They are built so that losing physical control of a device does not mean losing your data.
  • Leave a record. Significant actions are written to an audit trail, so there is always an answer to who did what and when.

How you sign in

Section titled “How you sign in”

There is no separate ARROW password to create, store, or leak. ARROW hands sign-in to your organization’s identity provider, so you authenticate with the credentials you already use for your other work applications. If your organization requires two-factor authentication, ARROW enforces it automatically at sign-in. Sessions expire after a period of inactivity according to your organization’s policy. See Authentication for the full flow.

Who can see what

Section titled “Who can see what”

Every account has a role, and the role decides what that account can reach. Admins, Managers, and Users each see a different slice of the Console, and features that are not part of your role are simply not available to you. Your data is scoped to your organization: one organization’s clients, devices, requests, and results are never visible to another. See Users & Roles for how roles are assigned.

Access is over a private VPN

Section titled “Access is over a private VPN”

The devices you deploy do not open themselves to the internet. Instead, each device dials out and joins a private VPN, and the on-device tools (ARROW Manager and ARROW Control) answer only over that VPN. There is no public address to find and no open port to knock on.

Being on the VPN is not the same as being able to reach everything on it. Access is scoped to the consultants assigned to a device, and ARROW keeps that scoping in sync with your assignments automatically. Access is also one-way: a device you are testing from cannot open connections back toward your own workstation. See Network Access Control for how this works.

Your data, encrypted

Section titled “Your data, encrypted”

Your data is protected both while it moves and while it sits still.

  • In transit. Traffic to the Console runs over HTTPS, and the VPN that carries device traffic is encrypted end to end.
  • At rest. Data stored by the platform is encrypted, and so are the backups taken from it. Backups are held in encrypted object storage.
  • On the device. The storage inside every ARROW device is fully encrypted, so a lost or seized device does not give up its contents. See Hardware Security.

Automation keys are scoped and expiring

Section titled “Automation keys are scoped and expiring”

When you connect ARROW to your own tooling with an API key, that key is limited to exactly the scopes you grant it and it must carry an expiration date, up to a year out. A read-only integration never holds write access, and a forgotten key stops working on its own. See API Keys for how to create and rotate them.

A record of what happened

Section titled “A record of what happened”

Significant actions across the platform are written to a signed, tamper-evident audit log and kept for years. It is the backstop for compliance questions and for after-the-fact review: who requested a device, who reached which system, when access changed, and what an automation key did on your behalf.

Security for each part of ARROW

Section titled “Security for each part of ARROW”

Each product in the suite has its own security details:

Reporting a security concern

Section titled “Reporting a security concern”

If you believe you have found a security issue, or something about your account or a device looks wrong, contact support right away rather than investigating it yourself. Fast reporting is the difference between a near miss and an incident.