generated: '2026-07-27'
method: searched
probe: true
source: https://www.arcadia.com/security
summary: >-
  Genability itself publishes no security page — genability.com redirects to
  Arcadia. Its parent, Arcadia, publishes "Security at Arcadia" with an explicit
  security-reporting contact and a PGP public key for encrypted reports. There
  is no formal responsible-disclosure policy document, no safe-harbour language,
  no bug-bounty program (HackerOne, Bugcrowd and Intigriti were all searched:
  no Arcadia or Genability program) and no RFC 9116 security.txt on any host.
policy:
- https://www.arcadia.com/security
contact:
- security@arcadia.com
contact_quote: >-
  "Have a question, concern, or need to report a security issue? Contact us at
  security@arcadia.com"
encryption:
  pgp_public_key_published: true
  location: https://www.arcadia.com/security
  note: PGP public key block published inline on the security page.
bug_bounty:
  program: null
  platform: null
  searched: [HackerOne, Bugcrowd, Intigriti]
safe_harbour: false
security_txt: false
security_txt_note: >-
  /.well-known/security.txt returns 401 on api.genability.com, 404 on
  docs.arcadia.com, and a soft-404 marketing HTML shell on genability.com. See
  well-known/genability-well-known.yml.
vulnerability_management_statement: >-
  "Technology is ever-changing and new software vulnerabilities are announced
  daily. We actively track and address all critical vulnerabilities, ensuring
  our platform and your information are as safe as possible."
security_controls_published:
- All network traffic forces HTTPS and uses TLS v1.2
- Rate limits in the authentication system against brute-force and credential stuffing
- Passwords one-way hashed and salted, never stored in plaintext
- Utility credentials encrypted with AWS KMS, in transit and at rest, with decryption logged
- Card and bank data handled by Stripe and Plaid; not stored on Arcadia infrastructure
evidence:
- source: https://www.arcadia.com/security
  kind: security page
  status: 200
  keywords: [report a security issue, security@arcadia.com, PGP public key, vulnerabilities]
caveat: >-
  This is the corporate parent's security page and covers the Arcadia platform
  as a whole; it does not name Genability or the Signal API. Recorded as the
  provider's disclosure surface with that qualification.