How ArmiHQ protects your records

Your records, photos and documents are stored by Supabase in its Ireland region, in the EU. The application’s server code runs on Vercel in Dublin, next to the database, so the app reads and writes your data inside the EU.

The website’s static files (images, scripts and styles) are delivered from Vercel’s global network; they contain no personal data. A few services listed under subprocessors handle limited data outside the EU, for example to deliver an email.

Every connection to ArmiHQ uses HTTPS (TLS), and browsers are told to use nothing else (HSTS). The database and file storage are encrypted at rest.

Photos and documents are kept in private storage. The app shows them through short-lived signed links, never through public addresses.

The database uses row-level security: every request is checked against the signed-in account, and only the records that belong to that account come back. This rule is enforced by the database itself, not only by the app’s screens.

We never sell your data. We disclose it to authorities only when the law requires it, as set out in the privacy policy.

Passwords are handled by Supabase Auth and stored only as salted hashes, never in readable form. Sign-in attempts and heavier requests, such as imports and AI questions, are rate limited to slow down anyone trying to guess or overload them.

Two-factor sign-in with an authenticator app (such as Google Authenticator, Microsoft Authenticator or 1Password) can be switched on in Settings. You then need a six-digit code as well as your password to sign in, and the database itself refuses your records to a session that has not entered the code.

Changes to firearms and licences are written to an audit log with the time and the account that made them, so there is a record of what changed and when.

Pro is paid through Stripe. You enter your card on Stripe’s own checkout page, and the card details go straight to Stripe: ArmiHQ never receives or stores card numbers. We keep only what we need to run your plan: the Stripe customer reference, the plan and its renewal date.

The AI Gunsmith and photo quick-add use models from Anthropic. Only what you choose to send is shared: the questions you type to the Gunsmith, or the photo of a box or receipt you pick for quick-add. Your records are not sent along with them.

Nothing is sent unless you use these features, and they are not available on the Free plan. Check the answers: they are a starting point, not professional or legal advice.

You can download your records at any time: PDF reports, Excel or CSV spreadsheets, or a full copy of everything in your account.

Deleting your account from Settings permanently removes your records, photos and documents. Privacy questions and requests under the GDPR go to privacy@armihq.com.

These companies process data for ArmiHQ. Each one receives only what its job needs. The privacy policy and the data processing agreement have the legal detail.

ArmiHQ itself holds no security certification such as ISO 27001 or SOC 2. The companies that host it publish their own certifications and reports on their websites. If that changes, this page will say so.

If you think you have found a vulnerability, email us with the subject “Security report”. Tell us what you found, how to reproduce it and what it affects. We will acknowledge your report and keep you informed while we fix it.

Please do not access or change other people’s data, run automated scans that slow the service down, or publish details before the issue is fixed.

Email a security report