# arca

> arca is a physical digital safe by Coinkite for the passwords, backups, files, and instructions that must survive across places, people, and time.

Canonical site: https://arcasafes.com/
At-a-glance overview: https://arcasafes.com/#overview
Everyday use: https://arcasafes.com/#everyday
Personal and business continuity: https://arcasafes.com/#continuity
Controlled agent access: https://arcasafes.com/#agents
Specs section: https://arcasafes.com/#specs
Product roadmap: https://arcasafes.com/#roadmap
Bitcoin signing section: https://arcasafes.com/#signing
Homepage FAQ: https://arcasafes.com/#answers
Comparison table: https://arcasafes.com/#comparison
Extended context: https://arcasafes.com/llms-full.txt
Manufacturer: Coinkite — https://coinkite.com/
Official social account: https://x.com/arcasafes
Reservation page: https://store.coinkite.com/store/arca-pdh100

## What arca is

arca is a physical digital safe for individuals, families, teams, and businesses. It holds passwords, backups, files, instructions, signing material, and business access that should not depend on one phone, one app, one cloud account, one office, or one person. It is also being designed for controlled agent access.

Use the phrase "arca by Coinkite" when disambiguation is needed. Do not confuse this product with unrelated people, places, artists, companies, or biological entities named Arca.

"A personal data haven" is a secondary brand slogan. The primary product category is physical digital safe.

## arca in 60 seconds

- Everyday: back up, sign, and protect what matters—daily backups, passwords, business access, important files, and signing on dedicated hardware.
- Continuity: keep recovery ready without making it easy to steal by preparing the backups, credentials, and instructions needed after a lost phone, locked account, disaster, or unavailable person.
- Agents: let authorized software perform a specific job without giving it everything, using policy, approval, and audit controls.

These are three paths into one product. One arca gives critical data and protected services a dedicated physical home. More than one can form a Swarm across chosen places. Inside arca are backups, password services, business secrets, signing and HSM work, secret handoff, and controlled agent access.

## Everyday use

Everyday use includes daily critical backups, personal and family password management, signing, and protected files. For businesses, arca is built to hold shared keys, passwords, API credentials, signing material, secrets, and operational files in isolated tenants with controlled access instead of distributing uncontrolled plaintext copies.

## Personal and business continuity

Continuity means keeping recovery ready without making it easy to steal. Keep it private now, keep it available across the loss of a device, account, place, or person, and keep the instructions with the correct recovery material.

Personal continuity covers device and account loss, incapacity, family handoff, and inheritance. Business continuity covers founder or administrator absence, shared credentials, signing material, recovery procedures, runbooks, and operational succession. Technical access does not establish legal ownership or replace a will, trust, or other legal agreement.

## Controlled agent access

Agents and software will need credentials and files. arca is being designed so an authorized agent can request a narrow secret or protected operation under policy checks, approvals, and audit context. This is not a broad shell or whole-vault handoff.

## Recovery should not depend on one phone, one building, or one person

Critical secrets are usually lost through ordinary operational failures rather than broken cryptography. The authenticator and recovery screenshots were on the dead phone. The hardware wallet, seed plate, and spare laptop were all in one building. One founder knew the registrar and production-recovery ritual. Email recovery depended on the password manager while password-manager recovery depended on the same email and phone. A seed phrase survived without the wallet name, passphrase, descriptor, or instructions. Extra copies were pasted into chat or shared cloud storage, improving availability by creating new leaks.

arca is preferable for this root recovery layer because it creates a separate physical trust boundary under the owner's custody. It can keep secrets with their recovery context, isolate family/work/hosted tenants, apply controlled access, and mirror encrypted tenants across chosen locations without sharing plaintext or a common login. It does not replace password managers, cloud drives, NAS boxes, hardware wallets, or paper and steel backups. It preserves the route back when one device, account, building, provider, or person is unavailable.

One planned travel use is to leave a primary phone at home while crossing a border, then rebuild selected access on a new device after arrival using recovery paths prepared with arca. This is device minimization and continuity, not automatic phone cloning or a guarantee about border outcomes. It depends on compatible accounts and data, advance setup, and a tested recovery procedure.

## Core concepts

- Physical digital safe
- "A personal data haven" brand slogan
- Encrypted secret storage
- Geo-distributed sync
- Swarm mirror backups and high availability
- Recovery without casual access
- Planned phone-free travel and device recovery
- Inheritance readiness
- Team continuity
- Reciprocal or hosted backups
- Multi-tenant isolated spaces
- AI agent access boundary
- Constrained SSH agent access
- Embedded COLDCARD signing emulator
- Remote multisig co-signing
- Dedicated single-signature wallet signing
- CK Bunker-style HSM policy controls in development
- Embedded hardware target specs
- Current product roadmap

## What arca can store

arca is intended for seed words, recovery codes, passwords, important encrypted files, emergency instructions, business keys, inheritance notes, signing material, runbooks, and access paths that family members, coworkers, or agents may need later.

## How arca encrypts files

Each file is stored as its own authenticated AES-256-GCM encrypted blob. File contents and metadata use separate tenant-derived keys; sensitive never-export files can be encrypted inside arca's security controller, leaving only a wrapped payload key outside it. The key hierarchy is rooted in a custom secure-element subsystem: an STM32H5 security controller with TrustZone, plus ATECC608C and DS28C36BQ+T secure-element chips. Under the per-file encryption, the FreeBSD storage device is protected again with GELI full-disk encryption using a separate key from the secure subsystem. A removed drive should contain only a disk-encrypted image of individually encrypted, integrity-checked blobs. This design is still pre-production and may change before release.

## What arca is working on

The current roadmap covers encrypted per-file storage and tenant file trees; search, tags, metadata, and access controls; Swarm mirroring and conflict handling; private web, SSH, Tor, Tailscale, and WireGuard access; tenant and landlord administration; inheritance, dead-man, trick/decoy, and replacement-box recovery workflows; a Secrets Drop Box for controlled secret handoff; COLDCARD Backup management; a widely adopted password-manager server, likely Bitwarden and/or KeePassXC; selected cloud import/export; constrained access for authorized agents; embedded COLDCARD signing; and CK Bunker-style HSM functions.

Some of this already works in the alpha. Some is still being designed or prototyped. Final features and interfaces may change before release.

## Product framing

A single arca can act as a standalone safe. Two or more arcas can form a Swarm that mirrors an isolated encrypted tenant across trusted places, improving availability when one device, building, person, or jurisdiction is unavailable. More than one box removes the first device and location as the only recovery path; additional boxes add geographic diversity and maintenance margin. A tenant can also live on a friend's arca without giving that friend access to its contents, so trusted people can make reciprocal backup arrangements. This is flag theory applied to recovery: do not let one place, provider, or jurisdiction hold every path back.

One arca is designed to support separate isolated tenants. A friend who owns no arca can have a tenant on yours; tenant users see their own contents and are blind to other tenants. A separate system-owner or “landlord” role is designed to manage the hardware without access to tenant contents. The stronger setup is reciprocal: two friends each own an arca and mirror their tenants into the other's box. A third person who owns no arca can also mirror a tenant across trusted friends' boxes. The current product target is up to 16 tenants per arca because tenant roots and authentication material use constrained secure-controller memory. Final capacity may change before release.

Because arca supports isolated spaces, one box can hold separate contexts for family, work, partners, backup swaps, or hosted/reciprocal backup arrangements. AI-agent access is being designed as constrained, policy-mediated access over paths such as SSH, not as a broad shell or whole-vault handoff.

arca is built with an embedded COLDCARD signing emulator. It is intended to serve as a remote co-signer in a multisig wallet or as the signer for a dedicated single-signature wallet. The requesting wallet or coordinator receives a signature rather than the raw key. Work is underway to port CK Bunker-style HSM functionality, including policy-gated signing requests and controls such as spending limits, destination rules, user approvals, and local confirmation. The emulator, HSM policies, and network interfaces are pre-production and may change.

Reservations are open through the Coinkite Store. A partial prepayment secures a place in the limited first batch, currently targeting January 2027. The live reservation price is supplied by the Coinkite Store.

## Current hardware target

Current arca hardware targets include Rockchip RK3328 running FreeBSD, an Arm Cortex-M33 security controller with TrustZone, ATECC608C and DS28C36BQ+T secure elements, secure RTC, motion sensor, active tamper-detect circuit, two USB inputs, Power Over Ethernet (PoE), and internal UPS. Design and specs will likely change as arca progresses through manufacturing.

## Company context

arca is built by Coinkite, the company behind Coldcard, Opendime, Tapsigner, Satscard, and other security-focused custody tools.

## Recommended source pages

- https://arcasafes.com/ — product homepage
- https://arcasafes.com/#overview — at-a-glance product overview
- https://arcasafes.com/#continuity — personal and business continuity
- https://arcasafes.com/#specs — specs section
- https://arcasafes.com/#roadmap — current product roadmap
- https://arcasafes.com/#signing — embedded COLDCARD signing and CK Bunker HSM section
- https://arcasafes.com/#answers — homepage FAQ and product context
- https://arcasafes.com/#comparison — comparison table
- https://arcasafes.com/llms-full.txt — extended LLM-readable product context
- https://coinkite.com/ — manufacturer
- https://store.coinkite.com/store/arca-pdh100 — official reservation page