Security

Securing your data is a daily commitment. This page describes the architecture, technical controls and processes we apply to protect the information you entrust to us. For the legal framework and data-subject rights, see our privacy policy and our nLPD page.

One instance per customer

Each customer has their own application containers and their own database, on a shared server. In ark.flow Compta, files are kept in a storage space reserved for the customer and accessed with the customer's own key. There is no pooling of application data between customers. In practice this means:

• Customer isolation — separate databases reduce the risk of an application request exposing another customer's data.
• Individual restore — we can restore one customer's database from its backups without touching other customers.

Encryption

Secrets (API keys, tokens and credentials for third-party services) are encrypted at rest using AES-256-GCM, with a master key stored outside the database. In ark.flow Fiduciaire, this master key encrypts a key specific to each customer (envelope encryption); in ark.flow Compta, each instance has its own master key. Data in transit travels over HTTPS through Cloudflare, then on to our servers with a Cloudflare origin certificate. Plain HTTP connections are systematically redirected to HTTPS.

Backups

Databases are backed up every day and archived with Borg on ark.swiss-owned infrastructure in Switzerland, which keeps:

• Daily — the last 14.
• Weekly — the last 8.
• Monthly — the last 24.

ark.flow Compta files are archived at least once a week, and its databases are also replicated continuously to the Infomaniak standby site in Geneva. Borg archives are encrypted and stored on infrastructure separate from the production servers. At every full cycle, an integrity check verifies the repository and a test file is restored.

Hosting

The application infrastructure is hosted exclusively in Europe. ark.flow Compta runs in production at netcup on a server in Vienna (Austria, European Union), with a hot standby site at Infomaniak in Geneva. ark.flow Fiduciaire runs in production at Infomaniak in Geneva. Independent backups are kept on ark.swiss-owned infrastructure in Switzerland.

Authentication and sessions

• Passwords — hashed with bcrypt, a deliberately slow algorithm that holds back brute-force attacks.
• Sessions — HTTP-only and Secure cookies (SameSite=Strict in Compta, SameSite=Lax in Fiduciaire), tokens rotated on privilege escalation.
• CSRF — CSRF token (double submit) checked on all mutating requests.
• MFA — TOTP (RFC 6238) available in ark.flow Fiduciaire; once enabled, it is required at every sign-in.

Logging and audit

Sensitive actions are logged in the application: user and permission changes, AI assistant actions and, in ark.flow Compta, entry changes. The application adds entries to these logs without ever editing or deleting them; they are kept for as long as the instance exists. Server technical logs are centralised in Grafana and kept for 14 days. An extract can be provided to the customer upon a written, motivated request.

Infrastructure and defence in depth

• Host firewall with a default-deny inbound policy; administration with SSH keys over a private WireGuard network.
• Cloudflare in front, with DDoS protection.
• Application-level rate limiting (per-IP) on authentication and signup endpoints.
• Automated monitoring: availability probes with alerts, application errors collected in GlitchTip, TLS certificates managed by Cloudflare.

Development and supply chain

• Scanned code and dependencies — Trivy and Semgrep scans on our build server for every build.
• Automated testing — front-end (Vitest), back-end (Go testing) and E2E (Playwright) tests run before every release.
• Secrets injected through environment variables, never in source code.

Responsible disclosure

If you believe you have identified a vulnerability, please write to security@ark.swiss. We acknowledge your message and keep you informed of how it is handled. Please do not disclose the vulnerability publicly until we have had an opportunity to remediate.

Governance and documents

Our privacy policy and our nLPD compliance page detail the applicable legal framework and the rights you can exercise: Privacy policy, nLPD compliance, Terms of service.