One system of record
Your organisation's missions, versions and approvals live in one place: Arksa's cloud at general availability, or your own servers on Sovereign.
- Home
- Company
- Trust and security
TRUST Trust and security
One record, kept safe
Your missions are engineering work, and often confidential. Here are the principles Arksa is built on, and how we answer your security team.
- No advertising trackers
- Encrypted vault, keys only you hold
- Signed licence files
- Sovereign on your own servers
01 The short version
Four promises you can check
Early access today: single-user studio by invitation. Team cloud, accounts and billing open with general availability. In a Sovereign evaluation, your security team can verify this from the network traffic.
Read-only links that expire
Reviewers see what you share, for as long as you allow, and nothing else. Revoke a link and it stops working.
No selling, no ad tracking
We do not sell personal data and do not use advertising or cross-site tracking cookies.
Sovereign stays on your servers
On Sovereign, mission content stays on your servers and never reaches Arksa.
FIG. 01Data boundary
What reaches Arksa, plan by plan
What reaches Arksa on each plan. Pick a plan.
On your side
Reaches Arksa
02 Sovereign
A short list, nothing else
On Sovereign, Arksa keeps to the few calls the software needs to run, and none of them carries your missions.
- Only licence, reference-data and update checks reach Arksa
- None of your mission data, ever
- Air-gapped deployment by arrangement
What Arksa still holds
The account records Arksa needs to run your licence. We walk your security team through every field in a call.
FIG. 02Encryption
Keys only you hold
On cloud plans, the optional vault encrypts files before they leave your hands, with keys only you hold. Try it here: encrypt and decrypt a line, and this page sends nothing.
03 Accounts and roles
Least privilege, one matrix
One permission model, enforced on the server for every action.
- Four roles, one permission matrix
- Every sign-in and change in the audit log
- Checked on the server for every action
- Accounts are protected with modern password and session security.
- Every sign-in and every change is recorded in the audit log.
- Roles decide what each person can see and do, and the server checks them on every action.
| Permission | Viewer | Member | Admin | Owner |
|---|---|---|---|---|
| Read missions, files, results | Yes | Yes | Yes | Yes |
| Use own encrypted vault | Yes | Yes | Yes | Yes |
| Create, edit, delete missions | No | Yes | Yes | Yes |
| Run compute jobs | No | Yes | Yes | Yes |
| Invite and manage members | No | No | Yes | Yes |
| Manage share links | No | No | Yes | Yes |
| Read the audit log | No | No | Yes | Yes |
| Issue licence files | No | No | Yes | Yes |
| Billing and privacy settings | No | No | Yes | Yes |
| Change licence, delete org | No | No | No | Yes |
04 Licences
Licences that verify on site
A licence is a document Arksa signs, and it verifies on your site.
- 1Issue
Signed by Arksa
Arksa signs each licence, for every plan and every deployment.
- 2Carry
Delivered as a file
Your licence arrives as a small file for your site.
- 3Verify
Verified on site
Your servers check it where they run, with no call to Arksa.
- 4Renew
Renewed on request
Arksa issues a new licence file when your licence renews.
05 Studio, transport and hosting
Hardened where it runs
Web app
Served over HTTPS with a strict Content Security Policy.
Transport and storage
Traffic is encrypted in transit with TLS. Operator access is restricted, and every operator action is recorded in the audit log.
06Compliance
Commitments you can hold us to
Our privacy and disclosure commitments.
GDPR and UK GDPR
With an account, export it from the Privacy Center, or ask contact@arksa.space to delete it. Our DPA (draft) on request.
Responsible disclosure
Report privately and we fix it before anything is published. How to report
07On request
What your security team can have
Security documentation is in preparation, and we answer security questionnaires in a call.
- PublicValidation report
Every validation result, checked against published references. Validation
- On requestData processing agreement (draft)
Our DPA (draft), with the standard contractual clauses where they apply.
- In a callQuestionnaires
We answer your security questionnaire in a call.
Responsible disclosure
If you believe you have found a security issue in Arksa, the website, the studio or the API, please tell us privately first and give us reasonable time to fix it before any public disclosure.
- Report to
- security@arksa.space, subject “Security report”
- In scope
- arksa.space and its subdomains, the studio and the API.
- Out of scope
- Denial of service and load testing, social engineering and phishing, physical attacks, and our providers' own services (report those to the provider).
- What happens next
- We acknowledge reports promptly and keep you informed. We credit you when the fix ships if you wish.
- Encrypted channel
- For a sensitive report, write first without the details and we agree an encrypted channel with you.
Please do not access or change other people's data, degrade the service for others, or use social engineering. Include steps to reproduce, and we keep you informed as we fix it.
08 Questions
Asked by privacy teams
They are on the Legal page.
With an account, you can export your data from the Privacy Center in the app at any time. To delete your account, write to us and we delete it. Depending on where you live you can also ask to access, correct, restrict or object to processing of your personal data. If your account belongs to an organisation, some requests about its content go to that organisation.
Catalogue, Earth-orientation and space-weather data come through your workspace, or your own server on Sovereign. The privacy policy lists every provider.
No. Vault items are scoped to their owner and encrypted with keys only the owner holds. Admins can switch the vault on or off for the organisation, not read it.
✉Briefing · under NDA
Bring your security questions. We answer them in a call.
We answer your security questionnaire in a call; security documentation is in preparation.
Request a briefing- Your questionnaire, answered in a call
- The data boundary, plan by plan
- Our DPA (draft)
Web studio today · Sovereign on your own servers
Your missions, your choice of servers
Request access for your team, or talk to us about Sovereign on your own servers.