Security and Compliance at Arino One

1Dedicated, single-tenant instances

Every client runs on a dedicated instance with its own database, authentication and Infobip boundary. Full row-level security means no shared tenancy — your data is not co-mingled with another customer's at any layer of the stack.

Because your instance is yours, a GDPR export or erasure scopes cleanly to one workspace — no cross-tenant untangling. The code is yours too: export it, or take the whole instance with you.

2Encryption in transit and at rest

All traffic between clients, the Arino One platform, Infobip and downstream channel providers is transported over encrypted channels (TLS). Message content, contact records and credentials are stored on encrypted volumes on the underlying regional database (EU by default).

3Regional hosting

Every instance is engineered in the EU and deployed in the region you choose — EU by default, with North America and APAC available for regulated global rollouts. See EU data residency for the GDPR alignment in detail, or Global coverage for regional options.

4Access controls & audit logging

Role-based access control and audit logging are built into the core platform on every instance:

• Role-based access control over who can see and act inside the Conversational Studio.
• Audit logging across privileged actions so changes are traceable.
• Consent events recorded alongside contact records.
• Data-flow logging across the messaging path — inbound, outbound and channel transitions.
• Scoped per instance — no cross-tenant visibility.

5Penetration testing & independent review

The platform is subject to periodic penetration testing in line with Meta Platform Terms and GDPR Article 32 obligations. Findings are triaged, remediated and re-tested; a summary is available to enterprise customers under NDA on request to hello@arino.one.

6Data-subject rights & erasure

Every instance ships with the GDPR rights engine described in the Privacy Policy — Article 15 access, Article 20 portability and Article 17 erasure are native controls, not paperwork.

Anyone whose personal data sits on an Arino One instance can submit an erasure request through the self-service form at arino.one/erase. Identity is verified before the request is executed against the instance and a written confirmation is returned.

7Responsible disclosure

Found a vulnerability? Please report it privately so we can fix it before it is disclosed publicly. Email hello@arino.one with a description, reproduction steps and any proof-of-concept. We will acknowledge your report and keep you informed through remediation.