Changelog

The gateway now blocks all incoming requests until initialization completes — including DLP model loading, policy store hydration, and provider health checks. No traffic is processed in a partially initialized state.

Production containers run with read-only root filesystems, dropped Linux capabilities, and non-root users. Rust-compiled hot paths protect performance-critical DLP operations from reverse engineering.

Users can recover account access through a self-service flow that verifies identity via email and secondary factors. Passkey enforcement ensures recovered accounts maintain phishing-resistant authentication.

A full configuration audit verified every environment variable, feature flag, and runtime setting against documented defaults. End-to-end validation tests confirm that policy enforcement, DLP scanning, and audit logging work correctly across the complete request lifecycle.

The platform has been hardened against all categories in the OWASP Top 10:2025 — including injection prevention, broken authentication controls, access control enforcement, SSRF protection, and security misconfiguration remediation. Twenty findings identified during a pre-release security audit have been resolved.

Production containers now run with read-only filesystems, dropped Linux capabilities, and explicit build directives — reducing the attack surface for container escape and privilege escalation scenarios.

Admin operations, configuration backups, and policy templates are now strictly tenant-scoped. Webhook and custom endpoint URLs are re-validated on every request to prevent DNS rebinding and SSRF attacks.

Passwords now require 12 characters minimum with complexity rules, and are checked against a compromised-credential database on registration and reset. A new registration gate lets administrators control whether open signup is permitted or require invite-only access.

DLP accuracy scores are measured continuously across all detection categories.

The Netskope and Zscaler comparison pages now include dedicated accuracy transparency sections. Both pages document that Arbitex publishes accuracy metrics measured against a comprehensive labeled dataset with per-entity CI gates — and that neither CASB vendor publishes comparable per-entity accuracy data.

The enterprise data isolation blog post now includes a dedicated section mapping each isolation tier (Shared, Enhanced, Outpost, Air-Gap) to regulatory acceptance context for HIPAA, GLBA/SEC Reg FD, NIST AI RMF, and ITAR/EAR. Security architects evaluating deployment architecture now have explicit compliance guidance per tier.

A new feature page at /features/dlp-accuracy publishes measured DLP accuracy with four interactive chart sections: hero accuracy bars, a category radar chart across PII/Financial/Medical/Secrets/Infrastructure, a 3-tier pipeline flow diagram with accuracy annotations, and a competitive benchmark comparison showing that Arbitex is the only vendor publishing methodology-backed numbers.

Detection categories are now broken out visually on the DLP accuracy page, so the covered data categories can be read at a glance rather than inferred from a single combined figure.

A static SVG version of the hero detection-quality panel is available at /social/dlp-accuracy-bars.svg for embedding in sales engineering decks and presentation materials.

A new blog post walks through the four-tier data isolation model — Shared, Enhanced, Outpost, and Air-Gap — covering per-tenant guarantees, the difference between architecture-level and configuration-level isolation, and a decision framework for choosing the right tier.