Trust is earned in the details. Here are ours.

ARKCRON follows a client-side encryption model. Plaintext and decryption keys exist only on enrolled user devices. ARKCRON Cloud stores ciphertext, wrapped keys, public keys and the operational metadata needed to run the service. The full layered architecture is described on the Security page.

• Item encryption: AES-256-GCM with unique per-item keys.
• Key derivation: Argon2id (RFC 9106), memory-hard, per-account salt.
• Key establishment for sharing and sync: hybrid X25519 + ML-KEM-768 (FIPS 203), rolling out.
• Signatures: hybrid Ed25519 + ML-DSA (FIPS 204), on the roadmap for device enrollment and policy integrity.
• Transport: TLS 1.3; hybrid post-quantum key exchange where the client platform supports it.
• Every ciphertext carries an algorithm version to support crypto agility.

ARKCRON is designed so it does not need access to plaintext vault contents. Your master secret is never transmitted. Item titles, URLs and contents are encrypted before sync. The AI Security Engine receives derived signals only.

Because of this design, ARKCRON cannot reset your master password or recover your vault without a recovery method you set up in advance.

Account sign-in supports passkeys, FIDO2 security keys and TOTP. Phishing-resistant factors are the default. Risk-based step-up applies to new devices and anomalous behavior. Enterprise accounts can enforce SSO, device trust and conditional access.

• Isolated production environments with infrastructure as code and peer-reviewed changes.
• Just-in-time, MFA-protected, logged administrative access; no standing production access.
• Encryption at rest for all storage, in addition to client-side encryption.
• Continuous configuration monitoring, centralized logging and 24/7 alerting.
• Backups encrypted and tested for restore.

We collect the minimum data needed to operate the service. Data processing is designed with controls aligned to GDPR and KVKK, including data subject rights, documented retention periods and sub-processor transparency. Customers can export and delete their data at any time.

We welcome reports from security researchers. Please email security@arkcron.com with steps to reproduce. We commit to acknowledging reports within 2 business days, keeping you informed, and not pursuing legal action for good-faith research that respects user privacy and avoids service disruption.

Our /.well-known/security.txt lists current contact details and our PGP key.

• Dependency and container scanning on every build; SAST in code review.
• Independent penetration tests at least annually and before major releases.
• Risk-based remediation targets: critical findings prioritized for immediate fix.
• Security advisories published for issues affecting customers.

Recent changes (illustrative entries for this prototype):