Privacy policy

1. Introduction and Data Controller

Archknot is an enterprise architecture platform engineered and operated by Quantackle (“Quantackle”, “we”, “our”, or “us”). This Privacy Policy explains how we collect, store, protect, process, and delete personal data and project architectural information when you access or use Archknot via archknot.com, its APIs, and associated web services.

We are committed to data minimization, transparent processing, and strict multi-tenant isolation. Under the EU General Data Protection Regulation (GDPR), UK GDPR, and the California Consumer Privacy Act (CCPA), Quantackle acts as the Data Controller for your user account information and as a Data Processor for your organization's workspace and architectural data.

2. Information We Collect

• Account and Authentication Credentials: When you register or sign in, we collect your business email address and secure authentication hashes. Password hashing, multi-factor authentication (MFA) tokens, and session credentials are encrypted and managed via Supabase Auth. Plaintext passwords are never accessible or stored on our servers.
• Project and Architectural Content: Requirements briefs, domain interview answers, latency/RPO/RTO constraints, system topology diagrams, Architectural Decision Records (ADRs), FinOps parameters, threat modeling risk scores, and generated Terraform configurations. All project data is stored in partitioned PostgreSQL databases protected by tenant-scoped Row-Level Security (RLS).
• Technical Telemetry and Security Logs: IP addresses, request headers, user agent strings, and audit timestamps captured at the edge layer by Vercel to protect against brute-force attacks, DDoS attempts, and unauthorized API access.
• Integrations (Optional): If you explicitly connect GitHub to export generated Terraform pull requests, we temporarily process OAuth access tokens scoped exclusively to the specific repository you authorize.

3. How We Use Your Data

• To interview requirements and synthesize multi-cloud architecture strategies across AWS, Azure, GCP, and Kubernetes.
• To compute FinOps 10x cost scaling simulations, STRIDE threat models, and disaster recovery quorum calculations.
• To generate implementation-ready Infrastructure-as-Code (Terraform) and ADR evolution documentation for your team.
• To enforce workspace access controls, tenant isolation, and multi-user collaboration.
• To comply with statutory legal and security auditing obligations.

4. Non-Training Policy & Confidentiality Commitment

Your architectural trade secrets remain yours. Under no circumstances do we sell, rent, monetize, or disclose your system requirements, cost calculations, or generated topologies to third-party data brokers or advertisers.

We explicitly warrant that customer architecture requirements, interview answers, and generated code are never used to train, fine-tune, or reinforce public AI or Large Language Models.

5. Subprocessors and Infrastructure Partners

We partner exclusively with SOC 2 Type II and ISO 27001 certified infrastructure vendors to deliver high availability and resilience:

• Supabase Inc. (USA / EU): Database hosting, PostgreSQL storage with Row-Level Security (RLS), and authentication provider.
• Vercel Inc. (Global Anycast Edge): Serverless application execution, edge routing, and TLS 1.3 termination.
• GitHub Inc. (USA): Optional customer-initiated Git repository synchronization and pull-request publishing.

6. Data Security and Cryptography

All communications with Archknot are encrypted in transit using TLS 1.3 with modern cryptographic cipher suites. All data at rest is encrypted using industry-standard AES-256 encryption. Access within our engineering teams is strictly gated by principle of least privilege (PoLP), multi-factor hardware keys, and comprehensive immutable audit logging. For full technical details, visit our Security Overview.

7. Data Retention and Deletion

We retain your project workspaces for as long as your account remains active. You maintain full ownership and control:

• You may export all project requirements, ADRs, and Terraform configurations at any time in standard markdown and HCL formats.
• When you delete a project or close your account, all associated database records, threat matrices, and version histories are immediately flagged for deletion and permanently purged within 30 days.
• Technical edge access logs are automatically cycled and purged on a rolling 30-day schedule.

8. Your Rights Under GDPR, UK GDPR, and CCPA

Depending on your jurisdiction, you have statutory rights regarding your personal data, including the right to access, rectify, port, restrict, or erase your data, and to lodge a complaint with a competent supervisory authority. To exercise any of these rights, email us directly at privacy@quantackle.com.

9. Changes and Privacy Inquiries

We may periodically update this Privacy Policy to reflect platform improvements or statutory compliance updates. Material modifications will be communicated via your account email or prominent notices on the platform.

For privacy questions, Data Processing Agreement (DPA) requests, or security inquiries, please contact our Data Protection Office at privacy@quantackle.com or write to Quantackle Legal, legal@quantackle.com.