This text is a translation. If it differs from the Turkish version, the Turkish version prevails.
1. Two places
Customer data lives in the customer's installation, on infrastructure the customer controls. AppArch's own systems hold only the website, customer-relationship records and licence records. This policy covers both.
2. Data stays in the installation
Analysis runs as a job in the customer's own CI on the checked-out code and sends findings to the customer's own AppArch server. Source code, findings, reports and user accounts are not sent to AppArch, and there is no usage telemetry. Licence and update checks carry only the installation identifier, an instance identifier and the software version; an air-gapped installation works without them.
3. Security built into the software
Git tokens, AI keys and other secrets are stored encrypted (AES-GCM) with a key that belongs to the installation and are never shown again in full. Sign-in supports two-factor authentication and LDAP / Active Directory; roles limit what each user can see and change; and sign-in history is kept. The licence is verified offline with an RS256 signature.
4. Services the customer chooses
Connections to Git providers, issue trackers and an AI provider are made by the customer with its own credentials. If an AI provider is connected, only the details of the finding being resolved are sent to it, under the customer's account.
5. Releases
Images are distributed through AppArch's registry, which only an installation's credentials can access, and each release is versioned by a single tag. Security fixes ship as new releases.
6. AppArch's own systems
Access to customer-relationship and licence records is limited to staff who need it and protected with encryption in transit, access control and logging; staff are bound by confidentiality.
7. Support access
AppArch has no standing access to any installation. Support works with information the customer chooses to share, or in a session the customer starts and ends.
8. Vulnerabilities and incidents
Report a vulnerability to info@apparch.io. We acknowledge it, fix it and take no legal action against researchers acting in good faith. In an incident affecting AppArch's systems we limit the impact and notify affected customers and authorities as the law requires.
AppArch Teknoloji Bilişim ve İnovasyon A.Ş.
Halkalı Mah. Halkalı Cad. Zaim Teknopark, Teknopark İdare Binası No:281/23 İç Kapı No:35, 34303 Küçükçekmece / İstanbul
Tax Identification No.: 0711060834
Web: apparch.io
Email: info@apparch.io