Security & Compliance
Encryption
ArkCloud encrypts designated PHI fields inside the database and encrypts public traffic in transit. The disk, the database volume and the backups of the hosted service are not encrypted today. This page sets out each layer so you can judge it for yourself.
Written for: Security reviewers · Compliance officers
Summary
| Field or control | What it means |
|---|---|
| Designated PHI fields | Encrypted at the field level with AES-256-GCM. |
| Database volume and file system | Not encrypted. The hosted service runs on a single virtual machine without disk encryption. |
| Database backups | Not encrypted. A daily backup is kept on the same machine for 14 days, with no off-site copy. |
| Public traffic | TLS 1.2 or 1.3 at the edge; plain HTTP is redirected; HSTS is set. The edge reaches the application through an encrypted tunnel. |
| Card data | Never reaches ArkCloud; it is entered in fields hosted by the payment processor. |
Field-level encryption
| Field or control | What it means |
|---|---|
| Algorithm | AES-256-GCM (authenticated), a random 16-byte IV per value, key derived with scrypt. |
| What is encrypted | Clinical narrative - clinical documents, therapy notes, assessment and episode-of-care text, goals, portal message subjects and bodies - and sensitive identifiers such as Social Security numbers, insurance group numbers, disbursement bank details, and the name, date of birth and contact details on new-patient requests, referrals and registrations. |
| What is not | Values the application must search, sort or constrain on: record identifiers, codes, amounts and dates - including the core patient record's name, date of birth, medical record number and insurance subscriber ID. Every PHI field left in clear is listed with its reason in the platform's PHI encryption policy. The tokens Google returns at sign-in are also stored without field encryption. |
| Encrypted secrets | Authenticator-app (TOTP) secrets and platform credentials are also encrypted, and so - since 2 October 2026 - are the secrets an organisation enters to reach its own systems: the Amazon Connect secret access key, collection agencies' API keys and FTP passwords, and webhook signing secrets. A value saved before then is still read in clear and is encrypted when it is next entered. |
| If the key is missing | The production service refuses to start rather than store PHI in clear. |
Key management
| Field or control | What it means |
|---|---|
| Where keys live | In the server environment of the hosted service. The RCM and clinical data domains can each be given their own key; where no separate key is set they share one. There is no key-management service or hardware security module. |
| Who can read them | ArkCloud's administrators of the production host. |
| Per-customer keys | No. All organisations on the hosted service share the same keys. |
| Rotation | Not automatic and not scheduled. Rotation is a re-encryption script an operator runs with the old and new keys; it re-encrypts stored values in place and checks each one with the new key. |
| Backup of keys | Keys are deliberately excluded from database backups and must be held separately; a restored database is unreadable without them. |
Encryption in transit
Browser traffic terminates TLS at the Cloudflare edge, which accepts TLS 1.2 and 1.3 and redirects plain HTTP. HSTS is sent with a two-year max-age. From the edge to the application, traffic runs through an outbound encrypted tunnel; the application host accepts no inbound web traffic. The database and cache run on the same host as the application. Connections from the application to outside services (email, payments, telephony) use each provider's TLS endpoint.