Privacy Policy

1. Who we are

Arbiter (arbiterid.com) is operated by Grayhaven Labs LLC, an Oklahoma limited liability company (“Grayhaven”, “we”, “us”). Contact us about privacy at tyler@grayhavenindustries.com.

We have not appointed a data protection officer or a representative in the EU or UK.

2. Our two roles

Arbiter handles two different kinds of personal data, and our role differs for each.

Your account, if you sign in to the Arbiter dashboard (“operators”), and visits to arbiterid.com

We are the controller. Grayhaven decides how this data is used.

Data about our customers’ own end users, sent to Arbiter to make authorization decisions (“Customer End-User Data”)

We are a processor, or service provider, for the customer. The customer decides how this data is used.

If you are an end user of one of our customers, that customer is responsible for your data. Please contact them first. We will help them respond. Customers who need a data processing addendum can contact us at tyler@grayhavenindustries.com.

3. What we collect as a controller

Operator accounts

• Sign-in data, held by Clerk. We use Clerk to create accounts and sign people in. Clerk stores the details you sign in with, such as your email address, and your session records. For some sensitive steps, such as approving an action or creating a key, the dashboard asks Clerk to verify you again.
• What Arbiter’s own database stores about you. Your Clerk user ID (a string that starts with user_), your Clerk session ID when you act, and your workspace memberships. Arbiter’s own database does not store your email address or name.
• What you create in the dashboard. Each item is recorded with your user ID:
  • Notes on decisions. A note is permanent. You can edit its text for 15 minutes after you create it. After that it cannot be changed or deleted by anyone through the Service.
  • Labels you set on decisions.
  • Saved views of the decisions list (a name and a filter). These are private to you in that workspace.
  • Alert rules and the webhook addresses alerts are sent to.
  • Workspace names.
• Workspace creation checks. When you create a workspace, we record a rate-limit bucket derived from your IP address: the full address for IPv4, or the /64 network prefix for IPv6. We also send your IP address and a bot-check token to Cloudflare Turnstile. See section 6.

Website visitors

• Our website is hosted on Vercel. Vercel processes request data, such as IP address and user agent, to serve and protect the site.
• The Arbiter code includes no advertising, analytics or tracking scripts, and no Vercel Analytics or Speed Insights.
• Fonts are bundled with the site at build time, so pages do not load fonts from Google when you visit.

Cookies and browser storage

Clerk session cookies

A cookie set by Clerk to keep you signed in and protect the session.

Clerk sets how long it lasts.

sidebar_state

A cookie set by Arbiter to remember whether the dashboard sidebar is open.

Lasts 7 days.

arbiter:decision-columns:v1 and other preference keys

Local storage set by Arbiter to remember display choices, such as table columns, note filters and setup checklist progress.

Lasts until you clear it.

Feed display and webhook retry keys

Session storage set by Arbiter to keep the current view and an unsent retry through a page reload.

Lasts until the tab closes.

Turnstile widget

Set by Cloudflare for a bot check, only when you create a workspace or approve a security change.

Cloudflare sets how long it lasts.

These are all needed to run the Service or to remember choices you made. We do not use cookies for advertising.

4. Why we use operator and visitor data

If the GDPR or UK GDPR applies to you, these are our legal bases for each use.

Create and secure your account; sign you in

Contract.

Run the dashboard and record who did what in a workspace

Contract, and our legitimate interest in an audit trail.

Prevent abuse of sign-up and workspace creation

Our legitimate interest in security.

Send alerts and notices to webhook addresses you configure

Contract.

Comply with the law and enforce our Terms

Legal obligation, and our legitimate interests.

Where we ask for your consent, we rely on that consent, and you can withdraw it at any time.

We do not sell or share personal information, as those words are used in US state privacy laws. We have no advertising or analytics trackers.

5. Customer End-User Data we process for customers

Customers send data to the Arbiter API so it can decide whether an action may go ahead. We process it only on the customer’s instructions. What we store depends on how the customer integrates. It can include:

• Identifiers. Principal IDs (the person or organization an action is for), actor IDs (the person, agent or client acting), credential IDs and session IDs. These are identifiers chosen by the customer.
• Decisions and the actions they cover. The action name, its parameters (for example, a payment amount, invoice ID, target resource, key scopes and lifetime), the verdict, the reason, the policy version and a hash of the input.
• Authority records. Grants and delegations, including the approved task text; approvals; pending actions and their holds; scheduled executions; redemptions and receipts; outcomes.
• Session evidence. Trust sessions and their revisions; session signals the customer’s backend sends (such as “session revoked” or “unexpected actor”); session assertions signed by the customer’s backend, and the public keys used to check them.
• Passkeys. When an end user registers a passkey through WebAuthn, we store the passkey’s public key, credential ID, signature counter, transports, authenticator model identifier (AAGUID), backup state and device type. We do not receive or store the private key or any biometric data. Biometric checks stay on the user’s device.
• Notice channels. An opaque reference chosen by the customer and its kind (email, SMS, push or in-app). We do not store the email address or phone number, and we do not send email, SMS or push messages. The customer’s systems deliver notices through webhooks.
• Investigation data. Research annotations and queue status that customer staff add while reviewing decisions.

How we keep tenants apart. Every tenant record carries an organization ID and an environment ID. API credentials belong to one organization and environment. Each request is checked against those keys, and an operator can reach a workspace only through an active membership.

No cross-customer use. We do not use one customer’s End-User Data to make decisions for another customer. We do not train models on raw Customer End-User Data. We do not correlate data across customers. Any change would require the customer’s explicit written agreement.

Credentials. API keys and platform tokens are stored only as SHA-256 digests. Generated secrets are shown once and not stored.

Audit export. Customers can export decision records as CSV or JSON Lines. An export contains the decision ID, time, action, verdict, status, reason, principal, actor, target, amount and currency, invoice ID, policy version, input hash, claim status and receipt ID. It leaves out action arguments, generated secrets, evidence details, session and credential signals, and approved task text.

6. Service providers (sub-processors)

We use these providers to run the Service.

Clerk

Operator sign-up, sign-in, sessions and re-verification.

Receives operator account and session data.

Vercel

Hosts the website and dashboard. Functions run in region iad1 (US East).

Receives all website and dashboard traffic, including data passing between your browser and the Arbiter API.

Railway

Hosts the Arbiter API, the webhook outbox, the alert evaluator, the shadow dispatcher and the PostgreSQL database. All production services are in region us-west2 (US West).

Receives all stored data.

Cloudflare (Turnstile)

Bot checks when an operator creates a workspace or approves a security change.

Receives a challenge token, the visitor’s IP address and data Cloudflare collects in the browser widget.

Trigger.dev

Runs background jobs: webhook delivery and shadow reviews.

For webhook delivery it receives only a delivery ID; the job calls back to Arbiter, which sends the webhook. For shadow reviews, the job fetches the decision’s evidence from Arbiter and passes it to TypeSafe AI.

TypeSafe AI (Jev model)

Shadow task-alignment reviews and shadow risk signals. Each is recorded for evaluation only and does not change the decision.

For one decision, it receives the approved task text, the proposed action name and its arguments, plain-language facts about the action’s effects, authenticated facts about the grant, any rationale the actor gave (marked untrusted), and whether the target, scopes and lifetime match the grant. Credentials and secrets are not sent.

For a risk signal on one action-trust decision, when we turn risk signals on, it receives the action name and type, the action’s recorded fields, the text the agent wrote in them (marked untrusted), the name of the other party if the action has one, and up to 20 names of other parties from the same customer’s earlier requests for that action. The verdict, grants and policy are not sent.

Webhook destinations are chosen by the customer. Arbiter sends signed alert and notice events to those addresses. They are the customer’s systems, not our sub-processors.

7. Where data is stored

We process and store data in the United States. The API, workers and database run on Railway in us-west2 (US West). The website’s server functions run on Vercel in iad1 (US East). If you use the Service from outside the United States, your data is transferred to the United States.

8. Security

What is built today:

• Tenant separation on every record and every request, as section 5 describes.
• API keys and platform tokens stored only as digests.
• Step-up re-verification through Clerk before sensitive dashboard actions.
• Bot checks and rate limits on workspace creation.
• Signed webhooks, and signed session assertions from customer backends.
• Passkey clone detection: a passkey whose signature counter goes backwards can approve nothing again.
• The website and dashboard are served only over HTTPS. Connections to model and telemetry providers must use HTTPS.

If a security breach affects personal data, we will notify affected customers without undue delay and as the law requires.

No security measure is perfect. We do not hold SOC 2, ISO 27001 or similar certifications.

9. How long we keep data

• We keep workspace data while the workspace exists. There are no automatic deletion jobs, except that stale, never-used workspace creation checks are cleaned up.
• Many records are append-only by design, including decision notes (after the 15-minute edit window), session signals, session revisions, approvals, grants, passkeys (revoked, not deleted), notice channels (revoked, not deleted) and research annotations. The database blocks their deletion.
• There is no self-service workspace deletion or full data export today. To close a workspace, email us at tyler@grayhavenindustries.com. We will then disable access to it.
• After a workspace is closed, we delete or de-identify the data the system allows. We keep append-only audit records only as long as we need them for security, legal and dispute purposes.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to our use of your data, and to data portability.

• Operators: email tyler@grayhavenindustries.com. We will verify your identity before we act on a request, and we will respond within 30 days. You can update account details held by Clerk in your account settings.
• Our customers’ end users: contact the business you deal with. We will help that business respond.

If you are in the EU or UK, you can also complain to your data protection authority.

11. Children

The Service is for businesses and is not directed to children. You must be 18 or older to use it.

12. Changes to this policy

We will post changes here with a new “Last updated” date. Before a material change takes effect, we will give 30 days’ notice by email or in the product.

13. Contact

Grayhaven Labs LLC
tyler@grayhavenindustries.com

The Terms of Service cover your use of the Service.