ARC's security position is published in full at /data-security, and that page is the authoritative statement. This article summarises it and points at the parts you can verify inside the product for yourself.

What the published statement says

Data ownership. You own your care records. ARC acts as a data processor for care documentation, and as a data controller only for account and billing information. Care data is "never sold, mined, profiled, or repurposed."

UK hosting. All production data is hosted in the United Kingdom, with infrastructure isolated by environment. "Care data is not transferred outside the UK."

Encryption. Traffic is encrypted in transit using modern TLS; data is encrypted at rest in the database and in backups.

Access control. Role-based permissions scoped to company and home level; users cannot reach records outside their assigned home; safeguarding records are restricted further and are not surfaced automatically in general timelines. All significant access and record changes are logged.

Backups and resilience. Encrypted backups daily, monitored, with documented and tested restoration procedures.

Secure development. Least-privilege infrastructure access, environment separation, secure password hashing, rate limiting and regular dependency updates.

Regulatory position. ARC is designed to support homes in meeting their record-keeping obligations under the Children's Homes (England) Regulations 2015, the Quality Standards, the Data Protection Act 2018 and UK GDPR. It does not replace professional judgement or regulatory responsibility — the registered provider and registered manager remain responsible for compliance. ARC is not affiliated with, endorsed by, or certified by Ofsted.

A Data Processing Agreement and supporting security documentation are available on request.

What you can see working

Three of those claims have a visible shape inside the product, which is useful when someone asks you to evidence them.

Access is layered and central. Company role, home role, DSL designation and time-boxed grants are resolved in one place, and the capability matrix in ARC's system documentation is generated by probing that same code rather than written by hand. See Who can see what.

AI stays in the UK. Where ARC uses AI or transcription, the region is pinned to London (eu-west-2) in region, and cross-region routing is refused by configuration rather than by convention. See How ARC uses AI and Voice dictation and your audio.

Access to sensitive records is logged. Safeguarding access, inspector sessions, subject access exports and every AI call each write their own audit trail, recording who, what and when.

Asking for documentation

Security questions and documentation requests go to security@arccare.co.uk, which is the contact given on the published page.