Security at Arena

Security is not a feature bolted on afterwards — it shapes how Arena is built. Four principles guide every decision.

1. 1

   Confidentiality by design

   Every participant sees only what their role permits. Nothing is exposed by default.

2. 2

   Least privilege

   Access to data and actions is scoped to the minimum needed for each role.

3. 3

   Provider independence

   Regulated activities run through vetted partners, so Arena is never a single point of failure for your funds.

4. 4

   Verifiable accountability

   Material actions are recorded in an immutable audit timeline.

• Encryption in transit (TLS) for all traffic, and encryption at rest for databases and uploaded documents.
• Secrets and credentials are held in environment-isolated configuration, never in source code.
• Passwords are stored only as strong one-way hashes.
• Uploaded documents live in access-controlled object storage, separate from operation metadata.

• Passwordless, single-purpose links for accountless participants — scoped to one operation and one role.
• One-time codes and magic links for secure sign-in.
• Bot and abuse protection (Cloudflare Turnstile) on public and authentication endpoints.
• Role-based authorisation checked on every request, server-side.

Arena never becomes a custodian of your money. Funds are held and moved by a regulated payment-infrastructure partner. Arena orchestrates the operation; the regulated partner performs the regulated activity.

• Continuous error monitoring and alerting keep issues visible and fast to resolve.
• An append-only audit timeline records every material action for traceability.
• Backups and recovery procedures protect against data loss.