We built ARX assuming our own servers are compromised.
The ARX architecture limits what any single component, including ARX itself, can see. This page summarizes how.
Encryption model
Each user has an identity key that certifies a separate key pair for each enrolled device. Private keys never leave the device that generated them and are unlocked with a smart card or FIDO2 security key. Each message is encrypted with a unique content key, wrapped individually for every recipient device. ARX servers store and relay ciphertext only. Mail arriving from outside ARX is encrypted by the secure gateway on receipt, after filtering, and is never stored in readable form.
| Key agreement | Hybrid X25519 + ML-KEM-768 key encapsulation, with a fresh ephemeral key per message |
|---|---|
| Content encryption | AES-256-GCM |
| Signatures | Ed25519 on every message and key event |
| Transport | TLS 1.3 with certificate pinning in the desktop client |
| Storage at rest | AES-256-GCM for stored ciphertext and metadata, keys held in hardware security modules |
| Key transparency | Device keys recorded in an append-only, verifiable log that every client audits, visible only to ARX members |
| Compliance access | Optional organization compliance key, held by the customer and added as a recipient for retention and legal hold. ARX never holds it. |
Infrastructure
- Two physically separate data centers in the Paris region, operated active-active.
- Infrastructure owned or exclusively leased by ARX. No public cloud provider and no subprocessor outside France.
- Client traffic terminates on a dedicated relay tier, isolated from storage and key management networks.
- Encrypted, immutable backups replicated between sites, tested quarterly and expired after 35 days.
Operational security
- No standing administrative access to production. Access is granted per task, under four-eyes approval, and fully recorded.
- All staff with production access are based in France and undergo background screening.
- Security testing of the client, relay and gateway before every major release.
- Documented incident response with customer notification commitments defined in our contracts.
Compliance
ARX is designed to help organizations meet their GDPR obligations and the confidentiality duties of their sector, such as professional secrecy. Architecture documentation is shared with customers under NDA.
Vulnerability disclosure
We welcome reports from security researchers. If you believe you have found a vulnerability in an ARX product or service, write to security team with enough detail to reproduce the issue. Our machine-readable policy is published at /.well-known/security.txt.
- We review every report we receive.
- We will not pursue legal action against good-faith research that respects this policy.
- Do not access, modify or retain data that does not belong to you, and do not degrade service availability.
- Allow us reasonable time to remediate before any public disclosure.
Evaluate ARX for your organization
Access is granted by invitation. Our team will walk you through eligibility and onboarding.