Five steps, in order. Nothing is abstract — every step maps to a named primitive in the whitepaper.
Ghost Mode is available on every paid tier. It is a posture, not a product — a declaration, at the start of a session, that nothing written during the session will survive it.
Not a marketing document. A cryptographic artifact that names the hardware, the firmware, the measurement, and the ArcaKey binding signature over all of it. Download a freshly-signed sample and verify it offline.
Pre-launch note: the NRAS evidence layer is stub-sourced until GCP A3 Confidential VM capacity is active. The ArcaKey binding signature over the artifact is real and verifiable today; transition to live NRAS is automatic on capacity cutover — the artifact shape does not change.
A tradeoff, stated plainly. User-held keys are the reason ArcaKey cannot read your vault. They are also the reason we cannot recover it for you.
Your vault’s content-encryption key is wrapped by a key derived from your passphrase or a FIDO2 token. The wrapping key never leaves your device. ArcaKey stores ciphertext. We do not hold the plaintext, and we do not hold anything that can unwrap it.
Lose the passphrase or token, lose the data. There is no backdoor, no “contact support.” This is stated explicitly in the retainer and acknowledged at checkout — because the moment a vendor can recover your vault, so can anyone who can impersonate you to that vendor.
A preview of how the vault reads during a working session — ink, ivory, and a single restraint of champagne. The aesthetic of a private bank, in digital form.
Start an Executive pilot, or request a Sovereign call. Thirty days at a contracted rate, then the standard fee — or cancellation.