Creating a workspace or accepting an invitation needs a verified email address.
An invitation works only for the address it was sent to, and for 7 days.
Arbituro refuses a session in which someone is signed in as another person.
Agents connected over MCP sign in the same way, as the person who connected them, and the MCP server takes no API keys. See Connect Claude.
Programs that use Arbituro’s API sign in the same way, or with an API key that someone in the workspace made. A key acts as that person in one workspace, and Arbituro doesn’t store its value. See API authentication.

Access

Every workspace’s data is kept separate, and Arbituro checks a person’s access on every request. A change to someone’s role, or removing them, applies on their next action. Agents read without asking, but nothing they send or change outside the workspace happens until a person approves it, each time or, for some changes to records, in advance. See People and roles and Approvals.

Where your data is

Arbituro is hosted in Sydney, Australia. Its backups are kept in Sydney, and its monitoring data in Australia. Card details go to Arbituro’s payment provider, never to Arbituro.

Annex III of the data processing addendum lists the providers that handle your workspace’s information.

When an agent sends an email, posts in Slack or creates a record in a connected service, the content goes to that service, at your direction.

AI models

To do a piece of work, a model receives text: the job and its comments, the text of attached files, what the agent reads from connected accounts, and the names of the people involved. It never receives the original files or images.
When web search is on for an agent, its search queries go to a web search service. When an agent makes a picture, the description of the picture goes to the provider of the model that draws it.
Arbituro doesn’t use personal information to train AI models, and every model provider it uses must be bound not to train on what it receives.
Customers are told at least 30 days before a new model provider starts handling their workspace’s information.

How it is protected

Traffic is encrypted with HTTPS, and browsers are told to use nothing else.
Sign-in tokens for connected accounts, sign-in app secrets and other credentials are encrypted at rest. Once saved, a sign-in app’s secret is never shown again or sent to the browser.
Other sites can’t show Arbituro inside a frame.
Requests are rate limited for each person, and a workspace runs at most 10 agent runs at once.
Uploaded files are limited to 25 MB.
Sensitive actions are recorded in each workspace’s audit log. See Activity and audit log.

Email and monitoring

Arbituro sends four kinds of email: invitations, the morning brief, the Monday digest, and a notice when a workspace is about to be deleted. None of them tracks opens or clicks.

Arbituro’s monitoring records which addresses were requested, without their query strings. It never records the prompts agents are given or what models write.

How long data is kept

A workspace’s jobs, conversations, files and records are kept for as long as the workspace exists.
Each entry in a workspace’s audit log is kept for 400 days. The record of which terms it accepted is kept for as long as the workspace exists.
When an owner deletes a workspace, its content is deleted 30 days later. Copies can stay in backups for up to 35 days after that.
Deleting a job doesn’t delete the agent runs on it.

The privacy policy has the full detail.

Export or delete your data

Export a workspace: An owner chooses Export workspace from the menu in Settings and gets every job, file and record as one ZIP file. The download link works once, for 2 minutes. The export leaves out secrets, such as connection tokens and keys, and the prompts Arbituro gives models.
Delete a workspace: An owner chooses Delete workspace from the same menu and types the workspace’s name. Everyone in it sees the date it will be deleted, 30 days later, and owners and admins are emailed. Until then, any owner can keep it. A paid plan stops renewing.
Delete your account: Choose Delete account at the foot of your profile. Your name then shows as Former member on your past work. Arbituro won’t delete an account while it is the only owner of a workspace or of a project.

Legal documents

Whoever creates a workspace agrees to the terms of service, the acceptable use policy and the data processing addendum for it. When they change, Arbituro asks the workspace’s owners, and one owner accepts them for the workspace.

Report a problem

Report a security vulnerability to security@arbituro.com, and give us reasonable time to fix it before you disclose it. Ask about your personal information at privacy@arbituro.com. For anything else, email support@arbituro.com. Support answers on business days, Australian Eastern time.

Something missing or wrong? Email support@arbituro.com.

Sign-in