What does Arkova actually do?

Arkova creates a permanent, independently verifiable proof of any credential or document. It anchors a tamper-evident fingerprint of the file to a public network, so anyone can later confirm the issuer, the timing, and the integrity — without Arkova ever holding the file.

How is this different from DocuSign, a notary, or a timestamp service?

DocuSign proves someone signed; a notary vouches with their seal — both depend on that vendor or person still being reachable years later. Arkova proves the exact document existed, unchanged, at a specific time, anchored to a public network no single company controls, so the proof survives even if Arkova, DocuSign, or the notary is long gone. It complements e-signature and notarization rather than replacing them: sign or notarize as usual, then anchor the result for permanent, independent verifiability.

Do you store my documents?

No. For documents you upload, fingerprinting happens in your browser and only the fingerprint and minimal metadata are transmitted. For documents pulled from a source you connect, such as DocuSign or Google Drive, the file is fingerprinted in memory on our servers and then discarded immediately; it is never written to our database, logs or storage. Even if we were breached, your documents stay private — because we never had them.

Can my document be reconstructed from the fingerprint?

No. A SHA-256 fingerprint is a one-way function: it maps any file to a fixed 64-character value that cannot be reversed back into the original. It confirms two files are identical without revealing anything about the contents. We can prove your document is authentic; we cannot read, reconstruct, or reproduce it — and neither can anyone who intercepts the fingerprint.

What does "tamper-evident" actually mean?

If a single byte of the original document changes, its fingerprint no longer matches the anchored one and verification fails. Integrity is provable by mathematics, not asserted by us.

What happens if Arkova goes away?

The proof outlives us. Because the fingerprint is anchored to a public network, a record stays independently verifiable even if Arkova's servers are offline or the platform that issued it shuts down.

What is the "public network" you anchor to?

An open, permanent, widely-replicated public network that no single company — including Arkova — owns or can quietly rewrite. Because the fingerprint is committed there rather than to our servers, anyone can independently check a record without trusting us, and the proof keeps working even if Arkova does not.

How does someone verify a record?

Every record has a public ID. Anyone can look it up — on the Verify page or with a single API call — to see the issuer, the anchor time, and the tamper-evident status. No account, and no access to the original file, required.

Can a record be revoked or corrected after it's anchored?

The original proof is permanent by design — that's what makes it trustworthy. But a record also carries a live status (Active, Revoked, Superseded, or Expired), and an issuer can revoke a record or publish a corrected version that points back to the original. Verification always shows the current status alongside the immutable anchor, so you get both an unforgeable history and an up-to-date state.

Can I integrate it with my systems?

Yes. A REST API (single-call and batch), HMAC-signed webhooks, and direct anchoring from sources like DocuSign plug into the SIS, LMS, HRIS, and ATS stacks you already run — with a full audit trail of every call.

The verification layer runs in production today; the full product is in early access. Join the waitlist and we will reach out to scope a pilot.

Privacy Policy

Effective Date: July 2, 2026 · Last Updated: July 2, 2026

This Privacy Policy explains how Bloc Doc Inc., trading as Arkova ("Arkova," "we," "us"), collects, uses, shares, and protects information when you use our website, application, and verification API (together, the "Service"). Arkova provides verification infrastructure: we create a permanent, independently verifiable proof of a document or credential by anchoring a tamper-evident fingerprint of it to a public network.

1. Our Foundational Guarantee

For documents you upload directly, the file never leaves your device. This is not a feature — it is the architecture. A SHA-256 fingerprint of the file is computed entirely in your browser using the Web Crypto API, and only that fingerprint (plus PII-stripped metadata) is transmitted. We never receive, store, or have access to your original files.

One narrow exception — connector-sourced documents. If you connect a third-party source you already control and authorize (for example, DocuSign or Google Drive), a document you select there is fetched and fingerprinted in memory on our servers, because there is no browser on your device in that flow to compute the fingerprint. In that case the raw file bytes are used only to compute the fingerprint and are then immediately discarded: they are never written to our database, our logs, our error-monitoring, or any temporary storage, and only the resulting fingerprint and PII-stripped metadata are retained. Documents you upload directly are always fingerprinted client-side and never transmitted at all.

2. When We Are Responsible, and When Your Organization Is

Some of the information described below is information we decide how to use, such as the details we hold to run your account, take payment, and keep the service secure. We are responsible for that information, and this policy explains how we handle it.

Other information reaches us because an organization has asked us to verify a document or credential. That organization decides what is submitted and why, and it remains responsible for that information. We act only on its instructions. If your document or credential was verified through Arkova by an organization you deal with, that organization's privacy notice applies, and you should contact them to exercise your rights. We will help them respond, but we cannot answer for them.

3. Information We Collect

Document fingerprints: A one-way SHA-256 fingerprint of your file. It cannot be reversed to reconstruct the original document and reveals nothing about its contents.

Account information: Email address, name, and organization name when you create an account.

Record metadata: Issuer name, credential type, issue/expiry dates, jurisdiction, and field labels — never raw document text or personal information extracted from a document.

Billing information: Subscription tier and payment status. Card details are handled by our payment processor (Stripe) and are never stored on Arkova's servers.

Usage and diagnostic data: Page views, feature usage, API call counts, and error diagnostics used to operate and improve the Service.

Marketing submissions: If you join the waitlist or contact us, the email address and interest you provide.

4. What We Never Collect

Original documents, PDFs, images, or file contents (beyond the in-memory fingerprinting described in Section 1)
Raw OCR text extracted from your documents
Social Security numbers, student IDs, or other personal identifiers from within documents
Your browsing history outside of Arkova
Payment card numbers (held only by our PCI-compliant payment processor)

5. AI Metadata Processing

When AI-assisted extraction is enabled, only PII-stripped structured metadata (credential type, issuer, dates, field labels) may be sent to our AI processor for structuring. Personal information is removed before any metadata is sent to our AI processor. For documents you upload directly, that removal happens in your browser, before anything is transmitted. Documents fetched from a source you connect, such as DocuSign or Google Drive, are not subject to AI metadata processing at all. They are fingerprinted in memory on our servers, the file is discarded immediately, and only the fingerprint and a fixed set of technical fields are retained. In neither case is raw document text or document bytes transmitted to the AI processor.

6. How We Use Information

To provide verification, anchoring, and API services you request.
To authenticate you and secure your account.
To process payments and manage subscriptions.
To operate, maintain, monitor, and improve the Service.
To communicate with you about the Service and, where you have opted in, product updates.
To comply with legal obligations and enforce our Terms.

Under the GDPR, our legal bases are: performance of a contract (providing the Service), legitimate interests (securing and improving the Service), consent (marketing email), and legal obligation. Under the Kenya Data Protection Act, 2019, we rely on the equivalent bases: our legitimate interests in operating an authenticated and secure service, performance of our contract with your organization, your consent for marketing email, and compliance with our legal obligations. We do not sell your personal information, and we do not use it for cross-context behavioral advertising.

7. Service Providers & Sub-Processors

We share the minimum data necessary with vetted providers who process it only on our instructions:

Provider	Purpose	Data
Supabase	Database, authentication	Account info, fingerprints, metadata
Stripe	Payments	Billing status (card data held by Stripe)
Google Cloud (Cloud Run, Secret Manager, Cloud Logging, Key Management Service)	Backend hosting, service execution, secrets management, audit logging, and key management	Account info, fingerprints, metadata, audit records
Google Cloud Vertex AI (Gemini)	AI metadata structuring	PII-stripped metadata only
Cloudflare	Edge network, secure ingress	Request routing (no document contents)
Vercel	Website hosting, privacy-friendly analytics	Aggregate, cookieless usage metrics
Sentry	Error monitoring	Diagnostics (PII-scrubbed)
Formspree	Waitlist / contact form	Email + interest you submit

The public network your fingerprints are anchored to is operated by independent infrastructure outside Arkova's control; it receives only the anchored fingerprint, which is public and contains no personal information.

8. Data Retention

We retain account and record metadata for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or anonymize the personal information associated with it within approximately 30 days, except where longer retention is required by law.

Security and audit logs are retained for up to 90 days. Billing and tax records are retained for 7 years from the end of the relevant financial period, as required by law.

Anchored fingerprints are permanent and public by design. A fingerprint committed to the public network cannot be deleted, recalled, or altered by Arkova or by you — permanence is what makes the proof trustworthy. Because the fingerprint reveals nothing about the document's contents and is not personal information, deleting your account does not, and cannot, remove a fingerprint that has already been anchored.

9. Cookies & Analytics

The marketing website uses privacy-friendly, cookieless analytics (Vercel Speed Insights) that measure aggregate performance and usage without tracking you across sites. The application uses a session cookie or local storage strictly to keep you signed in. We do not use advertising or cross-site tracking cookies.

10. Data Security

Data is encrypted in transit (TLS) and at rest. Database access is enforced through Row Level Security, so every table has mandatory tenant isolation. API keys are stored only as HMAC-SHA256 fingerprints, never in raw form. Audit events are written to an append-only, PII-scrubbed trail. Our security controls are published as a CSA STAR Level 1 self-assessment (a public disclosure of our controls, not a third-party audit or certification).

11. Your Rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing.

GDPR / UK GDPR (EEA & UK): access, rectification, erasure, portability, restriction, and objection, and the right to lodge a complaint with your supervisory authority.

CCPA / CPRA (California): the right to know, delete, and correct your personal information, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined by law, and we will not discriminate against you for exercising your rights.

To exercise any right, email hello@arkova.ai. We will respond within the timeframe required by applicable law.

12. International Data Transfers

Arkova is based in the United States and processes data there. Where we transfer personal information from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

13. Public Verification

Verification is public by design. Anyone with a record's public ID can confirm its status, issuer, and timing — no account required. Only the public ID and non-sensitive metadata are exposed; never the document itself, its contents, or the holder's personal information.

14. Children's Privacy

The Service is a business service and is not directed to children. We do not knowingly collect personal information from children. Where local law defines a child as a person under 18, including under the Kenya Data Protection Act, 2019, that definition applies. If you believe a child has provided us information, contact us and we will delete it.

15. Changes to This Policy

We may update this Policy. If we make material changes, we will update the "Last Updated" date and, where appropriate, notify you by email or in-app notice.

16. Contact

For privacy inquiries: hello@arkova.ai

Arkova is a trading name of Bloc Doc Inc., a Delaware corporation. Registered office: 131 Continental Drive, Suite 305, Newark, Delaware 19713, New Castle County, United States.