Trust & Security
Arodus connects to your books to monitor the vendors you pay. Here is exactly what we read, how it's protected, and what does and doesn't leave your account.
You connect through OAuth. Arodus reads your vendors, what you pay them and your company profile, and sends read requests only. On QuickBooks Online, Intuit's permission covers the whole accounting file, so the limit is enforced in our code: every request is checked against a fixed list before it's sent, and a build check blocks code that asks for anything else. On NetSuite, the integration role you install limits access the same way.
Your vendors
Who you pay: name, category, website domain, street address, phone, and city, state and country. We use the domain, address and phone to match and de-duplicate vendors, so AWS East and Amazon Web Services become one vendor with one record; address and phone aren't shown in the app. Contact names, contact emails and account numbers are used to match vendors and aren't kept.
What you pay them
Bills, payments, credits and refunds with your vendors, including payments made straight to a vendor by card, check or cash. For each: the vendor, the date, the amount, how it was paid and which bills a payment settled. The paying bank or card account isn't kept. Line items are kept only if you turn them on: off by default, and turning them off deletes them. Used to verify active relationships and calculate rolling 12-month spend.
Your company profile
Your company's name, location and website domain set up your account and let us recognize you if you're also a vendor in Arodus; only your workspace sees that link. Your book-close date marks which payments sit in closed periods. Street address, phone and contact email are deleted once your account is set up.
That's the whole scope: your vendors and what you pay them. Payments to anyone who isn't a vendor, such as employee reimbursements, are discarded before they're stored, and bank and card account details aren't kept.
Arodus runs a network where signals from many buyers sharpen risk and ratings for everyone. The boundary is strict, and it is worth reading closely.
Stays in your account
Your raw ERP records, your company identity, and your specific spend figures, visible only to your own workspace. To research a vendor, Arodus sends only that vendor's name and website domain to public registries and an AI model, with nothing that identifies you.
Shared as network signal
When you review a vendor, it appears to other buyers of that vendor in anonymized but attributed form: your role and a verified spend band, never your name or company, so others can judge relevance. Reviews are weighted by verified spend. Aggregate spend trends across the network also show on a vendor's profile, but only as relative movement, never your actual figures, and only once enough buyers contribute that no single account can be identified.
Individuals aren't monitored
If a vendor you pay is a person rather than a company, like a freelancer, Arodus doesn't monitor them. They show in your own account as an individual, with their name, location and what you pay them, and stay out of the shared network. Their street address and phone aren't kept.
Encrypted in transit
All data moving to and from Arodus uses TLS 1.2 or higher.
Encrypted at rest
Stored data is encrypted with AES-256.
Read-only access
Arodus only sends read requests, checked in code before every call. You can revoke access from your ERP at any time.
Credential security
Connection credentials sit in encrypted secrets management and are never logged in plaintext.
Access control
Production access is need-to-know, granted individually, protected by multi-factor authentication and reviewed regularly.
Breach notice and SOC 2
We notify you within 72 hours of a breach affecting your data. SOC 2 is on our compliance roadmap, Type I first and Type II to follow; we'll share each report once it's issued.
Our vendors are on our own record.
Every subprocessor that touches your data is a vendor we pay, and every one of them sits in our own Arodus workspace. Same daily cycle as your vendors, same six dimensions, same evidence rules. When one of them has an incident, we see it with the source attached, usually before it shows up in your questionnaire.
Operational
Outages, downtime and degradation, from vendor status pages and first-party disclosures.
Cybersecurity
Breaches, ransomware and actively exploited critical CVEs, from government alerts, breach filings and official disclosures. Breach indexes are matched by vendor domain.
Financial
Bankruptcy filings, liens, judgments and distress notices, plus sustained below-sector share price for public companies.
Compliance
Sanctions listings, significant GDPR fines, active litigation and government-mandated bans, from official registries, court records and watchlists.
Reputational
Executive misconduct, fraud claims and public-trust events, confirmed only by an official record or the vendor's own statement.
Strategic
Major acquisitions, geopolitical exposure and key executive departures, from official filings and first-party announcements.
Every event carries its evidence (Official record, First-party or Reported), its date and a source link. Reported items stay labeled until a record confirms them.
We mark every subprocessor event Relevant or Irrelevant, and a Relevant one opens a security review. If it affects your data, our 72-hour breach notice applies.
Our current subprocessor list, with what each one handles and where, is at arodus.com/subprocessors.
Revoke and delete anytime
Disconnect your ERP from your settings or from inside your ERP and syncing stops immediately. On cancellation or request, your account and ERP data are deleted within 30 days, and backup copies expire within a further 30 days.
What counts as verified
A verified event in Arodus always traces to a record you can check: a court docket, a regulator's breach filing, an SEC disclosure, a sanctions list, or the vendor's own statement. Press coverage, crowd-sourced trackers, and prediction-market forecasts appear in your feed labeled Reported, visible the day they surface and treated as verified only once the record exists.
- Arodus reads publicly available sources only.
- For press coverage, Arodus keeps the headline, the link, and the facts restated in its own words.
- Breach matching runs against public breach indexes using vendor domains, not personal email addresses.
- Every event carries its evidence in the audit trail, dated to when it was verified.
Ready when your security team is.
Take the tour on sample data today. Our DPA and subprocessor list are public; email security@arodus.com for a completed questionnaire.