Security and trust at Arkē

Arkē's three pillars process the minimum data necessary to deliver compliance analysis. You control what you send. We process it, return results, and — by default — do not persist anything beyond the request lifecycle.

• → Counterparty screening: receives entity names, jurisdiction, optional registration numbers. No full PAN, no biometric data, no full national ID required for the screening API.
• → Transaction monitoring: receives transaction metadata — amounts, corridors, timestamps, counterparty references. No raw payment credentials, card numbers, or IBAN sequences are required or retained.
• → SAR drafting: receives the facts you provide about the suspicious activity. The narrative is generated and returned to you. Nothing is filed on your behalf or stored without your instruction.
• → Default retention: none. In the MVP tier, data is not stored beyond the request–response cycle. Growth and Scale tiers offer configurable audit-trail retention (30, 90, or 365 days) with explicit opt-in.
• ✗ Never sent to third parties: your counterparty names, transaction data, and SAR drafts are not shared with, sold to, or used to train models for any third party. OpenAI receives only the anonymised analytical prompt — see sub-processors below.

• → In transit: All traffic between clients and Arkē endpoints is encrypted with TLS 1.3. TLS 1.0 and 1.1 are disabled. Cipher suites are restricted to AEAD constructions (AES-GCM, ChaCha20-Poly1305).
• → At rest: Any data persisted when the retention layer ships (Growth/Scale tiers) will be encrypted using AES-256 via the database provider's native encryption. This applies to all application data and backups.
• → Key management: Encryption keys are managed via the cloud provider's KMS (Neon / Render key management infrastructure). Keys are rotated automatically. Arkē does not hold or manage raw key material outside the KMS boundary.
• → API keys: Your Arkē API key is transmitted only over TLS. It is stored hashed (bcrypt) server-side. If compromised, revoke and reissue from your dashboard — old key is invalidated within 60 seconds.

Arkē operates as a data processor under GDPR Article 28. Your organisation is the data controller. You determine the purpose and means of processing. We process only on your documented instructions.

Arkē uses a minimal set of sub-processors. No data is sent to any service not listed here. We notify customers at least 14 days before adding or replacing a sub-processor.

All Arkē inference, storage, and application hosting runs inside the European Economic Area. No data leaves the EEA at any point in the processing lifecycle. This is a hard architectural constraint, not a configuration option.

• → Application hosting: Render Frankfurt region (eu-central-1). The Arkē API, web interface, and all compute run in EU.
• → AI inference: OpenAI EU API endpoint. Requests are routed to OpenAI's EU infrastructure. Data is not processed outside the EEA by OpenAI under this configuration.
• → Database: Neon PostgreSQL on AWS eu-central-1 (Frankfurt). All stored data, backups, and read replicas remain in EU.
• → DORA Art. 28 relevance: Financial entities subject to DORA must contractually ensure their ICT third-party service providers process data in the EU (or under adequate safeguards). Arkē's EU-only architecture satisfies this requirement by design — no SCCs needed.
• → MiCAR Art. 68 relevance: CASPs must ensure outsourced functions comply with applicable data protection and residency requirements. Arkē's EU processing satisfies the MiCAR outsourcing framework for compliance tooling.

If you find a security vulnerability in Arkē, we want to know. We commit to responding promptly, keeping you informed, and crediting researchers who report in good faith.

• → Report to: security@arke.polsia.app. Encrypt sensitive reports with our PGP key (published on request).
• → Acknowledgement: We acknowledge receipt within 1 business day. Initial triage assessment within 3 business days.
• → Disclosure window: 90-day coordinated disclosure window from date of acknowledgement. We will fix and publish a summary within this window, or request a single extension if a fix requires significant architectural change.
• → Bug bounty: No monetary bounty programme at this stage. Researchers who report valid vulnerabilities are credited publicly (with permission) in the security acknowledgements log.
• ✗ Out of scope: Social engineering, physical attacks, denial of service, vulnerabilities in third-party software outside Arkē's control, and issues already reported by another researcher.