Enterprise & shared vaults
RBAC, least-privilege sharing and access reviews across teams.
The AI-native security vault for the post-quantum era
Your identity.
Secured for what comes next.
AI-native credential and identity protection with zero-knowledge security and a crypto-agile architecture built for the post-quantum era.
Passwords. Passkeys. Identities. Secrets.
One intelligent security vault.
- Zero Knowledge
- Zero Trust
- Crypto-Agile
- Post-Quantum Ready
- Passwordless
- Least Privilege
- Privacy by Design
- Secure by Default
One vault
One vault. Every identity.
Everything that proves who you are — encrypted on your device before it ever leaves it.
Strong, unique, filled for you
Generate, store and autofill passwords for every site. Weak, reused and exposed passwords are flagged on your device.
Encrypted on device · AES-256-GCM
Bank of Example
login · personal
- Username
- alex@example.com
- Password
- ••••••••••••••••
- Strength
- Very strong · 112 bits
server view: { v:3, alg:"A256GCM", iv:"9f2c…", ct:"Qm9mL…" }
Passwordless and phishing-resistant
Create and sync passkeys across your devices. Private keys are bound to the real site, so a look-alike page can't use them.
Encrypted on device · AES-256-GCM
github.com
passkey · synced
- Relying party
- github.com
- Credential
- ES256 · discoverable
- Last used
- Today, 09:41
server view: { v:3, alg:"A256GCM", iv:"9f2c…", ct:"Qm9mL…" }
API keys and tokens, out of your code
Store tokens and environment credentials, inject them at runtime, and prefer short-lived credentials over permanent ones.
Encrypted on device · AES-256-GCM
prod / payments
secret · 3 values
- STRIPE_KEY
- rk_live_••••••••••
- Rotation
- Every 30 days
- Access
- deploy-bot · ttl 15m
server view: { v:3, alg:"A256GCM", iv:"9f2c…", ct:"Qm9mL…" }
Documents and recovery, in one place
Keep identity documents, recovery codes and payment cards encrypted, and share them with a trusted person when needed.
Encrypted on device · AES-256-GCM
Passport
identity · encrypted file
- Holder
- A. Morgan
- Number
- U•••••••
- Expires
- In 4 years
server view: { v:3, alg:"A256GCM", iv:"9f2c…", ct:"Qm9mL…" }
SSH keys that never sit on disk
Generate and use SSH keys through the ARKCRON agent. Approve each use with a passkey or biometric, per host.
Encrypted on device · AES-256-GCM
deploy@prod-eu
ssh · ed25519
- Public key
- ssh-ed25519 AAAAC3Nz…
- Private key
- Stored in vault
- Approval
- Biometric per session
server view: { v:3, alg:"A256GCM", iv:"9f2c…", ct:"Qm9mL…" }
ARKCRON AI Security Engine
AI that protects your secrets — without reading them.
Your device analyzes the vault locally. Only privacy-preserving signals reach the risk engine — never your plaintext secrets, never your master key.
- Spots weak, reused and exposed credentials before attackers do
- Flags impossible travel, new devices and unusual sign-in behavior
- Detects phishing indicators when a site doesn't match the saved one
- Explains every recommendation — no black-box decisions
Live risk analysis
Credential exposure
ARKCRON detected that this credential may have appeared in a recent breach. We recommend replacing it.
signal: k-anonymous hash prefix · plaintext never sent
Login blocked
Authentication behavior differs significantly from your normal pattern.
signals: new device · impossible travel (Istanbul → São Paulo, 40 min)
Vault
Plaintext on device
Local analysis
Strength, reuse, age
Signals
Scores, hashes
Risk engine
Score + advice
Sign-in request · Signals
- Device
- Managed laptop · trusted
- Location
- Usual country
- Behavior
- Matches pattern
- Policy
- Finance apps: phishing-resistant
- Passkey on trusted deviceLow risk
- Passkey + biometric re-checkElevated risk
- Hardware security key, or blockHigh risk
Multi-factor & passwordless
The right factor, at the right moment.
ARKCRON weighs device, location, behavior and policy, then asks for exactly as much proof as the risk requires — passkeys by default, stronger factors when it matters.
- Passkeys / WebAuthn
- FIDO2 security keys
- Biometrics
- TOTP
- Push approval
- Device-bound keys
- Adaptive MFA
- Risk-based policies
- Enterprise SSO
Zero-knowledge architecture
Your secrets belong to you. Not to us.
Encryption happens on your device with keys only you can derive. ARKCRON infrastructure stores ciphertext — designed so we never need access to your plaintext vault contents.
We store
Ciphertext, wrapped keys, public keys, minimal metadata
Designed never to receive
Master secret, vault keys, plaintext items
- 01
User master secret
on deviceYour master password or a passkey-unlocked device key. Never transmitted.
- 02
Local key derivation
Argon2id · RFC 9106Argon2id stretches your secret into a key-encryption key with a per-account salt.
- 03
Encryption on device
AES-256-GCMEach item is sealed with AES-256-GCM under keys wrapped by your vault key.
- 04
Encrypted data sent
TLS 1.3Only ciphertext and wrapped keys travel, inside TLS 1.3.
- 05
Ciphertext only, at rest
zero-knowledgeARKCRON infrastructure stores data it cannot decrypt on its own.
Post-quantum ready
Built for the post-quantum era.
Data stolen today could be decrypted by a future quantum computer. ARKCRON's crypto-agile design combines proven classical algorithms with NIST-standardized post-quantum ones — so an attacker would need to break both.
| Purpose | Algorithm |
|---|---|
| Vault encryption | AES-256-GCM |
| Password-based KDF | Argon2id (RFC 9106) |
| Key establishment | X25519 + ML-KEM-768 (FIPS 203) |
| Signatures | Ed25519 + ML-DSA (FIPS 204) |
| Transport | TLS 1.3, hybrid PQC where supported |
| Agility | Versioned ciphertext, re-wrappable keys |
Post-quantum ready is not “quantum-proof”. It means our design follows current NIST standards and can adopt new algorithms without re-encrypting your secrets by hand.
Security dashboard
Your security posture, in one glance.
A single score, the metrics that move it, and clear next steps from the AI Security Engine.
vault.arkcron.com
Good evening
Security overview
92/100
Excellent
Security score
Up 6 points since you enabled passkeys on 4 accounts.
- Weak passwords
3
- Reused passwords
2
- Compromised
0
- Passkey coverage
74%
- MFA coverage
91%
- Suspicious sessions
1
AI Security Insights
no plaintext accessed- Migrate
3 accounts can be migrated to passkeys.
Supported sites detected · on-device analysis
- Rotate
Your GitHub credential has not been rotated for 214 days.
Credential age signal · on-device
- Review
Sign-in from a new device requires verification.
MacBook · Frankfurt · 2 min ago
- Details
Overall identity exposure decreased by 18% this month.
Trend · 30 days
Sessions
- Trusted
iPhone 16 · Passkey
Istanbul
- Trusted
Windows · FIDO2 key
Ankara
- Step-up
MacBook · Password
Frankfurt
- Expires 42m
CLI · Short-lived token
eu-central-1
Enterprise identity security
Identity security your auditors can follow.
Centralize credentials, enforce policy, and prove it — with SSO, SCIM, conditional access and audit trails that stream to your SIEM.
SSO & SCIM
Provision and deprovision from your identity provider automatically.
Conditional access & device trust
Require compliant devices and phishing-resistant factors per app.
Audit logs & SIEM
Tamper-evident logs exported to your SIEM and SOC workflows.
- Microsoft Entra ID
- Okta
- Google Workspace
- GitHub
- GitLab
- AWS
- Azure
- Slack
- Jira
Designed to work with standard protocols (OIDC, SAML 2.0, SCIM 2.0, syslog/HTTPS). Product names are trademarks of their owners and do not imply partnership or endorsement.
ARKCRON Developer Vault
Fewer permanent secrets. More short-lived access.
Keep API keys, SSH keys and certificates out of repos and laptops. The CLI authenticates with a passkey and hands your app credentials that expire on their own.
Developer
ARKCRON CLI
Auth session
Temp credential
App / Cloud
zsh — arkcron
$ arkcron login --passkey✓ Authenticated as dev@example.com (passkey · device trusted)$ arkcron run --env prod -- ./deploy.sh→ policy: prod-deploy · approver: not required · risk: low injecting 3 secrets as env vars (never written to disk) AWS_ROLE sts session · ttl 15m DB_URL scoped read/write · ttl 15m STRIPE_KEY restricted key · ttl 15m✓ deploy finished · credentials revoked$ arkcron scan .! 1 hard-coded secret found in config/legacy.env:4 suggestion: arkcron import --from config/legacy.env --rotate$ Security architecture
Trust from architecture, not adjectives.
Five layers, one rule: plaintext and keys live on your devices. Everything beyond the device boundary handles ciphertext, signals and policy.
L5
Clients
- Desktop
- Mobile
- Browser extension
- CLI & SSH agent
Plaintext exists only here
L4
On-device crypto core
- Argon2id KDF
- AES-256-GCM
- Hybrid KEM
- Local AI analysis
Keys derived and used locally
L3
Transport
- TLS 1.3
- Hybrid PQC key exchange
- Certificate pinning (apps)
- Signed requests
Defense in depth over encrypted payloads
L2
ARKCRON Cloud
- Ciphertext store
- Auth & policy service
- AI Risk Engine
- Audit log
Stores ciphertext, never master secrets
L1
Integrations
- SSO / OIDC / SAML
- SCIM
- SIEM export
- Cloud credential brokers
Least-privilege, scoped, logged
Trust boundary between L4 and L3: only ciphertext crosses
Pricing
Start free. Grow into it.
The same zero-knowledge encryption on every plan. Upgrade for AI security, family sharing, or team identity security.
Free
Start securing your identity
$0$0forever
Get started- Zero-knowledge vault for 1 person
- Unlimited passwords on 2 devices
- Passkey storage and sign-in
- Weak and reused password alerts
- Basic breach monitoring
- Most popular
Personal Pro
AI-assisted protection for you
$3.99$4.99/ month
Start 30-day trialEverything in Free, plus
- ARKCRON AI Security Engine
- Identity and dark-web exposure monitoring
- Unlimited devices and passkeys
- Hardware keys, TOTP and push
- Secure notes, documents, SSH keys
- Emergency access
Family
Up to 6 people, one plan
$6.99$8.99/ month
Start 30-day trialEverything in Pro, for 6, plus
- Private vault for every member
- Shared family vaults
- Family security dashboard
- Guided recovery for members
- Child-friendly vault controls
Business
Teams and growing companies
$8$10/ user / month
Start free trialEverything in Pro, plus
- Team and shared vaults
- Role-based access control
- SSO with your identity provider
- SCIM user provisioning
- Security policies and admin console
- Developer vaults and CLI
Enterprise
Regulated and large organizations
CustomCustomannual agreement
Contact salesEverything in Business, plus
- Advanced IAM and access reviews
- Conditional access and device trust
- SIEM and SOC integrations
- Advanced, exportable audit trails
- Enterprise policy engine
- Dedicated support and security reviews
Prototype pricing in USD, excluding taxes. Every plan uses the same zero-knowledge encryption — security is never a paid upgrade.
Can ARKCRON see my passwords?
No. Your vault is encrypted on your device with keys derived from your master secret. ARKCRON's servers store ciphertext and wrapped keys only, and the system is designed so we never need your plaintext vault contents or your master secret.
How does the AI work if it can't read my vault?
Analysis that needs plaintext — strength, reuse, age, URL matching — runs on your device. Only derived signals such as scores, counts and anonymized hash prefixes reach the ARKCRON AI Risk Engine. The engine returns recommendations; your device decides what to show and you decide what to do.
What does “post-quantum ready” actually mean?
Key establishment for sharing and sync is designed to combine classical X25519 with ML-KEM-768 (NIST FIPS 203), so an attacker would need to break both. Vault data is encrypted with AES-256-GCM, which retains a large security margin against known quantum attacks. Every ciphertext carries an algorithm version so keys can be re-wrapped as standards evolve. It does not mean “quantum-proof” — no one can honestly promise that.
What happens if I forget my master password?
Because we can't decrypt your vault, we can't reset it for you. You can set up recovery in advance: a printed recovery kit, a trusted recovery contact, or a second enrolled device or passkey. Enterprise vaults can use admin-assisted recovery with a separately held recovery key.
Do I still need passwords if I use passkeys?
Increasingly, no. ARKCRON stores and syncs passkeys and tells you which of your accounts support them. For sites that still require passwords, the vault generates and fills strong unique ones.
Is ARKCRON certified?
ARKCRON publishes a compliance roadmap that includes ISO/IEC 27001 and SOC 2 Type II, and designs its controls in line with GDPR and KVKK. We will only display a certification once an independent audit has been completed. See the Trust Center for status.
Can I import from my current password manager?
Yes. Import from common CSV and encrypted export formats. Imports are parsed and encrypted on your device; the export file never needs to be uploaded.
Start with one vault. Keep it for what comes next.
Free for individuals. No card required. Your keys stay on your devices from the first minute.