Security

Authentication and access

A.R.C. is restricted to approved Spotlight Branding employees. Sign-in is handled through Google Workspace OAuth on accounts.google.com; A.R.C. never receives or stores Google passwords.

• Production sessions use secure, HTTP-only cookies that are unavailable to browser scripts.
• Owner, administrator, and member roles limit sensitive configuration and operational actions.
• Protected APIs reject requests that do not have a valid application session.

Integration credentials

OAuth tokens, API keys, and supported client secrets are handled on the server. Persistent connection records use authenticated encryption, and secret values are not returned in dashboard responses.

Disconnecting a supported integration removes A.R.C.'s active saved connection. When a provider does not support remote revocation, an administrator may also need to revoke or reset access in that provider's settings.

Storage and recovery

Application records use a private Supabase database as the live source. A.R.C. retains server-managed JSON rollback snapshots during the database transition and keeps connection credentials encrypted at rest.

• The Supabase recovery table is kept in a private schema with public database access revoked.
• Recovery copies are validated for both expected structure and checksum before restoration.
• Healthy application data is not automatically replaced simply because a recovery copy is newer.

Application safeguards

Production traffic uses HTTPS. Responses apply safeguards that restrict framing, content types, referrer information, unnecessary device permissions, and the external locations from which browser content may load or connect.

Operational monitoring records limited failure details and request identifiers to support investigation. Credentials and request bodies are excluded from system-alert records.

Shared responsibility

No application can guarantee absolute security. Employees should protect their Google Workspace account, use required multifactor authentication, connect only authorized service accounts, avoid sharing credentials, and report unexpected prompts or activity immediately.

Provider access should be removed when it is no longer required, and employee access should be reviewed whenever a person's role or employment changes.

Report a security concern

If you encounter unexpected sign-in behavior, unauthorized access, exposed information, or a suspicious A.R.C. page, stop using the affected feature and contact the platform owner. Do not include passwords, API keys, or client secrets in the report.