Skip to content

Security architecture

Zero-knowledge, by construction.

Your vault is encrypted on your device with keys only you can derive. This page explains exactly how — and what ARKCRON can and cannot see.

Visit the Trust CenterPost-quantum design

Key hierarchy

From your secret to ciphertext.

Four layers of keys, each with one job. Only the top of the chain depends on you — and it never leaves your device.

Your master password (or a passkey that unlocks a device-bound key) is stretched with Argon2id into a key-encryption key. That key unwraps a random 256-bit vault key, which in turn wraps a unique key for every item.

Because items have their own keys, sharing one item never exposes the rest of your vault, and rotating a key never requires re-entering your secrets.

  1. 01

    Master secret

    never transmitted

    Password or passkey-unlocked device key.

  2. 02

    Key-encryption key

    Argon2id

    Derived with Argon2id, memory-hard, per-account salt.

  3. 03

    Vault key

    256-bit

    Random 256-bit key, wrapped by the KEK and optionally by secure hardware.

  4. 04

    Item keys

    AES-256-GCM

    One key per item; encrypts data with AES-256-GCM.

  5. 05

    Ciphertext + wrapped keys

    Synced over TLS 1.3 and stored in ARKCRON Cloud.

Visibility

What we can see. What we're designed not to.

Data visibility
DataARKCRON can seeWhy
Master secretNoNever transmitted; only used on your device
Vault and item keysNoStored only in wrapped (encrypted) form
Item contents, titles, URLsNoEncrypted on device before sync
Encrypted blobsYes, as ciphertextRequired to sync and back up your vault
Account email, devices, billingYesRequired to run the service and secure sign-in
Sign-in events and risk signalsYesUsed by the risk engine; retained per policy
Item counts and timestampsYesNeeded for sync conflict resolution

Defense in depth

Controls around the cryptography.

Zero Trust access

Every request is authenticated and authorized; no implicit trust from network location.

Least privilege

Services and staff receive the minimum access needed. Production access is just-in-time and logged.

Secure by default

Phishing-resistant sign-in, strong KDF parameters and auto-lock are on from day one.

Crypto agility

Every ciphertext carries an algorithm version, so algorithms can change without data loss.

Independent testing

Third-party penetration tests and a public responsible disclosure program (see Trust Center).

Tamper-evident logs

Security-relevant events are signed and chained so changes can be detected.

Reference architecture

Five layers, one rule.

Plaintext and keys live on your devices. Everything beyond the device boundary handles ciphertext, signals and policy.

  1. L5

    Clients

    • Desktop
    • Mobile
    • Browser extension
    • CLI & SSH agent

    Plaintext exists only here

  2. L4

    On-device crypto core

    • Argon2id KDF
    • AES-256-GCM
    • Hybrid KEM
    • Local AI analysis

    Keys derived and used locally

  3. L3

    Transport

    • TLS 1.3
    • Hybrid PQC key exchange
    • Certificate pinning (apps)
    • Signed requests

    Defense in depth over encrypted payloads

  4. L2

    ARKCRON Cloud

    • Ciphertext store
    • Auth & policy service
    • AI Risk Engine
    • Audit log

    Stores ciphertext, never master secrets

  5. L1

    Integrations

    • SSO / OIDC / SAML
    • SCIM
    • SIEM export
    • Cloud credential brokers

    Least-privilege, scoped, logged

Trust boundary between L4 and L3: only ciphertext crosses
Read the full Trust Center

Read the architecture. Then decide.

Free for individuals. No card required. Your keys stay on your devices from the first minute.

Get Started — FreeTalk to sales