Security at ArchTruth

ArchTruth is a small product run by one person, so this page does not claim a compliance programme it does not have. It says exactly what the product does with your ServiceNow instance and your data, in enough detail that your security team can check it against the code and the ServiceNow OAuth record. Last reviewed 2026-09-06.

Your ServiceNow instance is read-only

The connector never writes to your instance. Every call ArchTruth makes to ServiceNow is a read (HTTP GET against the Table API); there is no code path that creates, updates or deletes a record. The one exception is the OAuth token exchange itself, which is a POST to the instance's token endpoint and touches nothing but the grant. Write-back is not a hidden feature waiting for a flag: it does not exist in the product, and adding it would be a documented, opt-in change.

The connection uses the ServiceNow OAuth authorization-code flow with PKCE. It acts as the ServiceNow user who approves the grant, so it can read what that user can read and nothing more. You can revoke the grant from ServiceNow at any time (System OAuth → Manage Tokens), and ArchTruth stops immediately.

Each sync is bounded: it walks cmdb_rel_ci outward from the configuration item you choose to a depth of at most four hops, stops at 500 configuration items, and reads a fixed list of CI fields (name, class, operational and install status, business criticality, ownership, support group, environment, location, IP/FQDN, version, short description, last discovered). Nothing else is pulled. Every sync is recorded as a job with who ran it and what it fetched.

Where your data lives

Data is stored in a Supabase Postgres project in AWS us-east-1 (Northern Virginia) and served through Vercel from the same region. Synced CMDB records and relations, diagrams, decision records, versions and audit trails all live in that database. Row-level security is enabled on every table, and cross-tenant isolation is covered by an automated test suite that runs on every change (anonymous, viewer, editor, owner and other-workspace roles).

OAuth access and refresh tokens are stored only in Supabase Vault, encrypted at rest, and read through security-definer functions; they never reach the browser or the application logs. API keys and share-link tokens are 192-bit random values stored as SHA-256 hashes and shown once. No secrets are kept in the code repository.

Version history, the audit trail, AI runs and exported change sets are append-only, enforced by database triggers rather than application code, so a bug in the app cannot rewrite history.

Access to ArchTruth

Sign-in is by magic link through Supabase Auth. Password sign-in is not enabled in production. Workspaces have owner, editor and viewer roles; billing entitlements can only be changed by the billing webhook, never by a user through the API.

The REST and MCP API authenticate with per-workspace keys carrying read or write scope. Write scope is enforced in the database, not only in the request handler, and every write requires an If-Match revision so an agent can never silently overwrite a human's edit. Keys are rate-limited (120 reads / 30 writes per minute) and every request is attributed to the key in the audit trail.

Transport and browser hardening

All traffic is HTTPS with HSTS. Every page carries a per-request nonce Content Security Policy (script-src 'self' 'nonce-…' 'strict-dynamic', object-src 'none', frame-ancestors 'none' except on shared read-only views, which reviewers may embed), plus X-Content-Type-Options: nosniff, a strict Referrer-Policy and Permissions-Policy. Third-party scripts and fonts are not loaded.

Input handling and abuse limits

Every request body and form is validated with a schema before anything is written. Diagram text is parsed server-side before it is stored; agent operations are validated by the same parser. SVG exports are produced by ArchTruth's own serializer with escaping, so user labels never become markup. Search terms sent to ServiceNow have query-injection characters stripped and are length-capped. AI features are rate-limited per user and metered per account.

What is not in place yet

ArchTruth has not completed a SOC 2 or ISO 27001 audit. There is no single sign-on yet (planned for Enterprise). Error monitoring and a paid database tier with point-in-time recovery are on the pre-launch list and will be in place before the first paying customer. If any of these is a hard requirement, tell us before you connect an instance.

Responsible disclosure

If you find a vulnerability, email <mike@mikereams.com> with "security" in the subject. You will get a human reply within two business days, and a fix or a mitigation plan before any public disclosure. We do not pursue researchers who act in good faith.