Security at arrowdel.

Security is a core engineering principle at arrowdel, not an afterthought. Whether we are building a client's product or operating our own systems, we apply consistent security practices across the full lifecycle — from design and development through deployment and ongoing support.

• Secure coding practices aligned with industry guidelines such as the OWASP Top 10.
• Peer code review on all changes before they are merged or deployed.
• Automated dependency and vulnerability scanning across our codebases.
• Input validation, output encoding, and protection against common web vulnerabilities (XSS, SQL injection, CSRF, and similar).

• Hosting on reputable cloud providers with strong physical and network security controls.
• Network segmentation and firewalls to restrict access between environments.
• Regular patching and updates of servers, runtimes, and dependencies.
• Continuous monitoring and logging of production systems for unusual activity.

We apply layered protections to data depending on its state:

• Access to client systems and data is granted on a least-privilege, need-to-know basis.
• Multi-factor authentication (MFA) is required for access to critical internal systems.
• Access is reviewed periodically and revoked promptly when no longer needed.
• Role-based permissions separate development, staging, and production environments.

We proactively monitor for vulnerabilities in the software we build and the tools we rely on, and apply patches on a risk-based timeline. Critical vulnerabilities affecting production systems are prioritized for immediate remediation.

Our practices are informed by widely recognized industry standards, and we adapt our approach to meet the specific regulatory requirements of each engagement — including frameworks such as HIPAA for healthcare projects or PCI-DSS considerations for payment-related systems, where applicable.

In the event of a suspected security incident, we follow a defined response process: containment, investigation, remediation, and notification to affected clients in accordance with our contractual and legal obligations. Post-incident reviews are used to strengthen our defenses going forward.

If you believe you have discovered a security vulnerability in our Website or a system we operate, please report it to security@arrowdel.com. We ask that you give us a reasonable opportunity to investigate and address any issue before disclosing it publicly.