Security

Written 19 September 2026

Arkhelion is built so that the most sensitive thing, your health history, never reaches me at all. What I don't hold can't leak from me.

On your Mac

• Your health history is kept in a database on your Mac that is encrypted at rest.
• The key that unlocks it is held by your Mac's own secure key storage, not by Arkhelion and not by me.
• There is no Arkhelion server that stores health data, so there is no central copy to break into.
• The app is not publicly released yet. Early copies are not yet signed by Apple, so I won't ask you to download anything until they are.

On this website

• Every page is served over HTTPS only, and browsers are told never to use plain HTTP.
• The site loads only its own files, plus Cloudflare's human check on the form. A strict browser rule blocks anything else from running.
• Email addresses are looked up by a scrambled copy that can't be turned back, IP addresses are shortened before they are stored, and confirm and unsubscribe links are stored only as scrambled copies.
• The visit counter keeps daily totals only, so there is nothing about you in it to protect.

Report a security problem

If you think you've found a security problem in the site, the list or the app, please email brock@arkhelion.ai with "Security" in the subject line. Please don't test on other people's data, and give me a fair chance to fix it before you tell others.

I reply within five working days and will tell you what I found and what I'm doing about it. There is no paid bounty yet, but I'll thank you by name if you'd like.