1. Encryption & Data Protection

All network traffic to and from Arkenwell is encrypted in transit using TLS 1.2 and TLS 1.3. Passwords are stored only as PBKDF2-SHA256 hashes, email one-time codes only as hashes, and authenticator-app secrets are encrypted at rest.

2. Authentication Security

User login sessions are authorized with RS256-signed JWT tokens; tokens using any other algorithm, including HS256, are rejected. Email one-time passwords (OTPs) are 6-digit, single-use codes that expire within five minutes.

3. Infrastructure Sub-Processors

We partner with industry-leading infrastructure providers including Cloudflare (web hosting and network security), Amazon Web Services in Mumbai (application servers and database), Google and Resend (email delivery), and Razorpay, a PCI-DSS compliant payment gateway (payment processing).

4. Security Disclosures

If you identify a security vulnerability or bug, please report it directly to our security team:

Security Contact: security@arkenwell.co

We acknowledge reports within 48 hours and work quickly to address valid security findings.