Done properly.
Behind the screen too.

Hosting and data

Websites, the client portal and the database are hosted by Simply.com in the EU. All traffic is encrypted with HTTPS, and browsers are told to always use an encrypted connection (HSTS).

The website

• No cookies for statistics or marketing.
• No fonts, scripts or images from third parties, so your visitors are not shared with anyone else.
• A strict Content Security Policy blocks any script that does not come from us.
• The site works without JavaScript; scripts are only an enhancement.

The client portal

• Access by personal invitation only. There is no public sign-up.
• Passwords are stored with Argon2id and never in plain text.
• Administrators must sign in with two-factor authentication (authenticator app). Clients can turn it on themselves, and we can require it for your organisation.
• Recovery codes for two-factor and a combined limit on login attempts per account, wherever the attempts come from.
• Each client sees only their own projects, messages and files.
• Sessions expire after 30 minutes of inactivity. A client who chooses "Remember me" stays signed in on that device for up to 30 days. Administrators cannot.
• Protection against forged form submissions (CSRF) and limits on repeated login attempts.
• Files are stored outside the public part of the server and served only after an access check.
• Changes are saved as new versions, so content is never overwritten.
• When the collaboration ends, all project data is handed over in one file, and the project is deleted 30 days later.
• The database is backed up automatically every day. Each copy is checked before it is stored, and the latest 14 are kept protected on the server.
• Important actions are logged — never passwords, codes or message content.

Sub-processors

Simply.com (hosting, database and email) in the EU. If a solution needs other sub-processors, they are listed in the data processing agreement before we start.

Data processing agreement

Whenever we process personal data on your behalf — for example enquiries from your own website — we sign a data processing agreement. Ask for our template or send us yours. You can also read how we handle data ourselves in our privacy policy (in Danish).

Accessibility

We build to WCAG 2.1 level AA and test every update of our own website automatically. Read our accessibility statement.

Found a security issue?

Contact us via support@arkelo.dk and describe what you found. We respond quickly and fix the issue before it is made public. Our contact details are also in security.txt.

Last updated: 30 October 2026