Skip to main content
Archil supports managed storage and bring your own bucket (BYOB). This page describes where your data lives, how we protect it, and what we’re prepared to sign.

​
Data ownership

  • Bring your own bucket (BYOB): Your data is stored in a bucket you own. Archil reads from and synchronizes writes to that data source on your behalf.
  • Managed storage: Your data is stored in a bucket managed by Archil. You do not need to configure or operate a bucket.
In both modes, active data is temporarily held in Archil’s storage layer. Newly committed writes are durable there while they synchronize to object storage. This temporary storage layer is part of the data path even when you bring your own bucket. With BYOB, files are synchronized to your bucket in their native object format, readable with any S3 tool and without Archil. Data already synchronized to your bucket remains there when you stop using Archil. With managed storage, export any data you want to keep before deleting the disk. For how to export data and what you can read without Archil, see Data ownership and portability.

​
Hosting

Archil offers public regions on AWS and Google Cloud. Additional regions are available in preview. Private deployments run on AWS, Google Cloud, Azure, or bare metal. See Region availability. Active disk data stays in the cloud and region selected for the disk. A BYOB data source stores the synchronized copy in the bucket and region you configure. Account and billing metadata are described separately in Subprocessors. Archil’s storage layer is designed for 99.999% (five nines) durability, achieved through replication across multiple Availability Zones and synchronization to object storage. Archil is designed for 99.99% availability. We can sign an availability SLA for Enterprise customers; contact us to discuss it.

​
Encryption

All data is encrypted at rest and in transit.
  • At rest — Data in Archil’s storage layer is encrypted with AES-256. In BYOB mode, data synchronized to your bucket uses that bucket’s encryption settings.
  • In transit — Client-to-service connections use TLS 1.2 or higher. Unencrypted connections are rejected.
Encryption keys are managed by Archil’s key management infrastructure and rotated on a regular schedule.

​
SOC 2

Archil undergoes ongoing SOC 2 Type II audits covering security, availability, and confidentiality. Audit reports are available through the Archil Trust Center. If you need a copy of our most recent report for your procurement or compliance review, contact us.

​
Data protection (GDPR & CCPA)

Archil is GDPR and CCPA compliant. We provide Data Processing Agreements (DPAs) to Enterprise plan customers. The DPA covers data residency, subprocessors, and breach notification commitments. Data residency is respected by default — Archil does not move data across regions without explicit configuration. To request a DPA, contact us.

​
HIPAA

Archil supports workloads subject to HIPAA requirements. We sign Business Associate Agreements (BAAs) with Enterprise plan customers. To request a BAA, contact us.

​
Access control

Archil provides layered access control to match your environment:
  • AWS IAM roles — Clients authenticate with their existing IAM roles. No additional credentials needed for EC2, Lambda, or ECS. See Disk Users.
  • Disk tokens — For non-AWS or cross-region access, a disk token grants a client mount access to one specific disk. Disk tokens are hashed before storage — Archil never stores them in plaintext.
  • API keys — The Control Plane API uses account-scoped API keys for managing disks, disk tokens, and users programmatically. API keys are separate from disk tokens.
  • POSIX permissions — Standard file permissions (owner, group, other) are enforced on all mounted disks.

​
Security testing

Archil partners with Casco Security for monthly penetration testing across our infrastructure. We also run continuous static analysis on every code change.

​
Vulnerability disclosure

If you discover a security vulnerability in Archil, please report it to security@archil.com. We target acknowledgment within 24 hours. We offer bounties for qualifying vulnerability reports — email us for details.

​
Private deployment

Bring Your Own Cloud (BYOC) is available to Enterprise customers. BYOC runs on any cloud, including AWS, Google Cloud, and Azure, as well as on your own bare-metal servers, and can include disks, persistent sandboxes, and serverless execution. Archil fully manages each deployment over an egress-only connection. Telemetry never includes PII or PHI: it is scrubbed inside your cluster before it leaves, file data is never logged, and file paths and names are blocked. Both the file system and storage layers run in your environment, so your disk data never leaves it. See BYOC for deployment, maintenance, and telemetry details.

​
Private networking

For organizations requiring private connectivity (e.g., AWS PrivateLink), contact us to discuss options.