Security Overview

This page describes, in plain terms, how Arkrel protects your documents and data. It is a summary for customers, not a certification or audit report.

Infrastructure

The API, dashboard, and file storage run on Cloudflare's global network: Cloudflare Workers for application logic, Cloudflare D1 for structured data, and Cloudflare R2 for file storage. Document extraction and verification are performed on Conecta Media LLC's own GPU servers, which pull work from the API over an outbound, authenticated connection; the extraction servers do not expose any inbound ports to the internet. If the extraction servers are briefly unavailable, an automated fallback path can use Cloudflare Workers AI so that jobs still reach a terminal state instead of getting stuck.

Encryption

All traffic to and from the API and dashboard is encrypted in transit with TLS. Files stored in R2 and structured data stored in D1 are encrypted at rest by the underlying Cloudflare platform.

Tenant Isolation

Every document, result, API key, webhook, and usage record is scoped to a single organization. Every database query used to serve customer data filters by organization, so one customer's data is never returned in response to another customer's request.

Authentication and Access

API access uses Bearer API keys. Keys are shown once, at creation time, in full; after that only a salted hash is stored, and the key itself cannot be retrieved again, only revoked and replaced. Sign-in to the dashboard uses a password (12 characters or more, checked against known data breaches, never stored in a way we can read it back), a passkey, or Google sign-in when configured. Accounts with a password must enable an authenticator app (TOTP) before checkout, billing changes, reports and exports, sharing, API keys and MCP, bank or ledger connections, team changes, email or password changes, sender allowlist changes, and callback secrets. This also applies with a linked passkey or Google sign-in. Accounts without a password keep their existing protection rules. The free first look stays open: verify your email, sign in, upload or email in your first statement, review merchants and rules, preview My year and the locked report, view pricing, or edit your profile name. You can sign out or delete your account without TOTP; deletion keeps its existing identity check. Account exports require completed protection. Account deletion remains available with its existing identity check. Existing accountant share reports and exports pause while their creator has a password without enabled TOTP and resume after setup. API keys and MCP credentials are checked against their creating user on every request. If that user has a password without enabled TOTP, requests return HTTP 403 TWO_FACTOR_SETUP_REQUIRED. Organization/service keys with no creating user keep their existing behavior. A fresh password, two-factor, passkey, emailed code for a passwordless account, or linked Google reauthentication check is also required before sensitive actions like creating an API key or rotating a webhook secret. Webhook payloads are signed with HMAC-SHA256 so you can verify they came from us, and each signed request includes a timestamp with a 5-minute replay window.

Bank Connections

Optional bank connections use Plaid. An owner or admin with a password must have a verified authenticator app and confirm their identity before connecting. Passwordless accounts retain their existing authenticator or passkey protection. Passkeys require biometric or PIN verification. Bank access tokens are encrypted using AES-GCM with a dedicated application encryption key and stay on the server. Plaid webhook signatures, exact body hashes and five-minute timestamps are checked before work is scheduled. Bank data is scoped to your organization. Statement PDFs use the same processing, page allowance and retention controls as uploads; transaction activity is displayed separately.

Account details and transaction activity remain while the connection is saved. Disconnect stops access through Plaid and removes the connection, recent activity and imported statement documents. Only a statement receipt remains, containing the statement identity, dates, import and removal record, so the same statement is not downloaded or charged again. Connections retired when a plan or entitlement ends have no Disconnect control. For these retired connections, imported statements stay in Documents under the same retention setting as uploads after bank access ends. You can delete them from Documents. Statement receipts are kept until account deletion. Account deletion performs the same remote removal. Temporary provider failures leave cleanup pending for automatic retry.

Internal Access

Access to production systems and customer data is limited to the people who need it to operate and support the Service, and is logged.

Data Retention and Deletion

Documents and extraction results are deleted automatically 30 days after processing by default, configurable from 1 to 90 days on paid plans. You can delete any document immediately, or delete your whole account yourself from Settings at any time: if you're the only member of your organization, deletion starts immediately, with a typed confirmation and a fresh password, two-factor, passkey, emailed code for a passwordless account, or linked Google reauthentication check required first. Deleted data is removed from our live system as cleanup completes, and from every backup copy within 30 days. You can also download all of your data yourself, at any time, from Settings. See the Privacy Policy for full detail.

AI Use

Your documents and extracted data are not used to train machine learning models, ours or any third party's.

Reporting a Security Issue

If you believe you have found a security vulnerability in the Service, email support@arkrel.com with details. We will acknowledge reports and work with you in good faith to understand and address the issue.

Passwordless accounts can confirm sensitive actions with a six-digit code sent to their verified email address. Codes are stored hashed, single-use, valid for 10 minutes, and limited to five attempts and three sends per 10 minutes. Codes are bound to the requesting user, session, email, and step-up purpose. Passkeys require biometric or PIN verification and a single-use challenge bound to the initiating live session for five minutes. Google cannot force fresh authentication; it is accepted only with a fresh auth_time, never token issuance time. Email codes and registered passkeys remain available when Google cannot complete verification.