Arc en Ciel trust

Technical Security | Arc en Ciel

A practical overview of visible technical safety features and security-related platform controls.

Last updated: 22 May 2026

Browser and Transport Security

  • Production traffic is served over HTTPS.
  • The production NGINX layer sends HSTS, Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and Referrer-Policy headers.
  • The API also uses Helmet for baseline HTTP security headers.

Account Protection

  • Accounts support email verification and password reset flows.
  • Users can enable authenticator-app two-factor authentication with recovery codes.
  • Authentication, two-factor, reset, register, and API key flows are rate limited.

Abuse Prevention

  • Registration can be protected with Cloudflare Turnstile.
  • Public, authenticated, write-heavy, and media routes use separate rate-limit profiles.
  • Moderation, DSA notices, illegal-content reports, audit logs, and admin tools are handled through restricted workflows.

Independently Checkable Signals

  • Browser security headers can be checked live with an HTTP client or external header scanner.
  • The security.txt file is a machine-readable vulnerability disclosure contact at /.well-known/security.txt.
  • Stripe Checkout and the Stripe Billing Portal can be verified during the supporter payment and cancellation flow; Arc en Ciel does not ask for card numbers directly.
  • Public integration repositories are inspectable on GitHub, including the current Link Key flow for local worker connections.
  • The model-safety production snapshot is generated from the production Version table at request time and exposes live format, hash, source, and scan-status counts.
  • Arc en Ciel does not claim a third-party security audit yet; this page separates externally checkable signals from operator self-statements.

Payments

  • Optional supporter memberships and one-time donations use Stripe Checkout and Stripe Billing Portal flows.
  • Supporter payments are not investments, securities, profit-sharing products, or guaranteed-return products.
  • Arc en Ciel does not accept cryptocurrency payments or direct bank transfers for supporter checkout.
  • Stripe webhook signatures are verified server-side.
  • Arc en Ciel does not store full payment card numbers on its own systems.
  • Billing, checkout, cancellation, and withdrawal support is available via [email protected].
  • Billing policy Supporter membership, donation, Stripe checkout, cancellation, and refund guidance.
  • Terms of Service Platform terms, supporter payments, acceptable use, and legal contact context.
  • Withdrawal policy Plain-language guidance for statutory withdrawal requests and immediate digital access.
  • Support page Product entry point for supporter checkout and the billing portal when signed in.
  • Stripe Third-party payment processor used for supporter checkout and recurring billing.

Model and Download Safety

  • Over 99.9% of model-weight files in the current production inventory are safetensors.
  • Safetensors files are preferred because the format avoids pickle execution during normal loading and can be structurally validated.
  • Local model uploads are hashed with SHA-256, and safetensors files are structurally validated before WebUI/AutoV3 hashes are stored.
  • Non-safetensors model uploads receive additional server-side checks, including ClamAV scanning and PyTorch safe-load validation for .pt files.
  • Files flagged as infected, potentially risky, or scan-error are blocked from normal download delivery.
  • External URL references that Arc en Ciel does not host locally are surfaced with an explicit UNVERIFIED_EXTERNAL source-verification status instead of being labeled clean.
  • A dedicated model-safety page exposes the policy and a crawlable production inventory snapshot.
Canonical: https://arcenciel.io/security
Robots: index,follow