Security & privacy documentation
How your account, your team's access, and your organization's data are protected — described without exposing internal implementation detail.
Who this is for
Anyone who wants to understand how their account and data are protected, and admins evaluating ARIA for their organization.
Sign-in protection
Sign-in attempts are rate-limited per source, so repeated incorrect attempts are automatically slowed rather than allowed to continue indefinitely. Passwords are never stored in a reversible form.
Sessions
A successful sign-in creates a session tied to your account. Session identifiers are stored in a cookie marked to resist theft through malicious scripts and to only be sent over secure connections. Sessions expire automatically and can be ended at any time by signing out.
Protection against forged requests
Actions that change data in your account (like updating a password or ending a session) require a verification token generated for your active session, so another site cannot trigger those actions on your behalf without your knowledge.
Roles and permissions
Customer accounts have one of three roles:
- Admin — highest customer-side role within the organization's enabled products and application permissions. Customer Admin does not grant Random Target AI internal access.
- Manager — operational access to areas allowed by the product/API role guards, including current Admin/Manager-only workflows such as customer ARIA Sales.
- Member — general customer access where permitted; some operational or management actions remain restricted to Admin/Manager.
Random Target AI internal staff with elevated access see a separate internal view used only for Random Target AI's own operations (see Ecosystem) — this is never available to customer accounts.
Organization isolation
Every record — customers, leads, conversations, knowledge, agents — belongs to exactly one organization, and every dashboard view and data request is scoped to the organization of the signed-in user. One organization cannot see or reach another organization's data through the dashboard.
Data handling
This documentation intentionally does not describe internal infrastructure, hosting, or third-party technical details — it focuses on what matters to you as a customer: your data belongs to your organization, access is role-controlled, and sensitive actions can require explicit confirmation before taking effect (see Approvals). For questions about data retention or deletion for your organization, contact your administrator or use the contact page.
Managing your sessions
- Open Settings from the dashboard.
- Review the Active sessions list.
- Select Sign out next to any session you don't recognize or no longer want active.
Known limitations
- Password reset is not currently self-service from the sign-in page — contact your administrator if you're locked out.
- Multi-factor authentication is not currently available.
Troubleshooting
Example: you're signed out unexpectedly. This usually means your session expired or was ended from another device — sign in again. If it keeps happening, check Settings → Active sessions for anything unfamiliar. For general access issues, see the troubleshooting guide.