QuodArca ZKS Conformance Statement
Status: Preliminary declaration of intended conformance. This is a vendor self-attestation describing the QuodArca architecture against the ZKS-1.0-RC2 assertions. The full evidence pack required by ZKS-1.0-RC2 Section 7.5 (version-bound scope declaration per §8.2.2, evidence categories E1–E4, and T-STR/T-OBS/T-CAP/T-REV test results per §8.6) is in preparation and not yet published. Until it is published together with a bound software version, this statement documents architectural intent and SHALL NOT be relied upon as a completed ZKS conformance determination.
| Field | Value |
|---|---|
| Product | QuodArca |
| Vendor | EISST International |
| Target Profile | ZKS-Core |
| Additional Properties | PSDA (Provider-Side Data Absence), documented |
| Statement Date | January 2026 (restated August 2026 against ZKS-1.0-RC2) |
| Assessment Type | Self-Attestation (preliminary; evidence pack pending) |
| Software Version Bound | Pending - to be declared with the evidence pack per §7.5.4 rule 4 |
Executive Summary
QuodArca is designed to satisfy ZKS-Core, and EISST International intends to demonstrate this through the Standard's own evidence requirements.
The QuodArca architecture is designed so that no third party - including EISST International - possesses the technical capability to:
- Access or decrypt user information
- Obtain the complete set of components required to decrypt user information
- Revoke a user's ability to decrypt their own data
Beyond ZKS: Provider-Side Data Absence (PSDA)
QuodArca additionally targets Provider-Side Data Absence: no QuodArca-operated service stores user ciphertext at rest. This provides security properties beyond ZKS requirements:
- No user content on provider infrastructure: QuodArca infrastructure holds no user content to breach, exfiltrate, or compel. It does hold operational metadata (device/item identifiers, sync events) and TTL-bounded wrapped keys, which are producible under legal process but are not decryption-enabling.
- User-controlled storage: All ciphertext resides on user devices and user-controlled CLinks
- Reduced legal exposure: QuodArca cannot be compelled to produce user content it does not possess; requests for content are properly directed at the data controller
Orthogonal Properties
| Property | Question Answered | QuodArca Design Target |
|---|---|---|
| ZKS Compliance | "Who can ever decrypt?" | Only the user |
| PSDA | "Who ever possesses the encrypted data?" | Only user-controlled systems |
Assertion Mapping (Design Statement)
The table below maps the QuodArca design to the ZKS-1.0-RC2 assertions. "Designed to conform" indicates architectural intent pending the published evidence pack; it is not a tested conformance result.
| Assertion | Description | Status |
|---|---|---|
| A1 | CSD-Only Decryption | Designed to conform (evidence pending) |
| A2 | Exclusive Key Material Possession | Designed to conform (evidence pending) |
| A3 | No Third-Party Decryptability Assembly | Designed to conform (evidence pending) |
| A4 | No Third-Party Revocation of Decryptability | Designed to conform (evidence pending) |
| A5 | Plane Separation and OP Blindness | Designed to conform (evidence pending) |
| A6 | User-Governed Topology and Relocation | Designed to conform (evidence pending) |
| A7 | Metadata Minimization and Non-Correlation | Designed to conform (evidence pending) |
| A8 | Recovery and Reset Safety | Designed to conform (evidence pending) |
| A13 | Update Transparency | Designed to conform - see Update Transparency below (evidence pending) |
| A9 | UKRS / Key Separation Mode (conditional) | Implemented; designed to conform with sovereign restoration (evidence pending) |
| A10 | Cross-Domain Collaboration (conditional) | Implemented; designed to conform - sharing uses no unblinded re-encryption proxies or server-side key wrapping (evidence pending) |
| A11 | Enterprise Delegation (conditional) | Not Implemented (N/A) |
| A12 | Opaque Policy Enforcement (conditional) | Not Implemented (N/A) |
Architecture Overview
QuodArca implements a four-layer architecture with strict vertical-only communication:
- app-ui - User interface (within CSD)
- app-mngr - Application logic (within CSD)
- app-svs - Services including cryptographic engine (within CSD)
- app-ext - External services (QKEYS, QCLOUD, QP2P, QMSVC, QBEND)
All external services are designed to be cryptographically blind - they handle only opaque encrypted blobs and cannot decrypt user data. QKEYS holds wrapped keys (TTL-bounded) while ciphertext resides with distinct third-party storage providers under user account control; this cross-entity separation is compliant under the per-entity Coexistence Prohibition (ZKS-1.0-RC2 §2.2.2). QMSVC/QP2P relay handling is transient per §2.2.12 and will be documented as such in the evidence pack.
Update Transparency (Assertion A13)
QuodArca implements Sigsum binary transparency with:
- Blake3 cryptographic hashes
- Ed25519 signature of manifest
- Public, append-only transparency log
The evidence pack will include the public log location, inclusion proofs for released binaries, and T-CAP-4 results.
This preliminary attestation was prepared by EISST International. It will be superseded by a full conformance statement satisfying ZKS-1.0-RC2 Section 7 evidence requirements (scope declaration, version binding, E1–E4 evidence, and §8.6 conformance report). It is subject to the public challenge process described on the Assessments page.