Technical platform
Arcen establishes an encrypted channel, verifies the Pier identity, and only then submits credentials to the target operating system.
Direct transport
The direct transport is QUIC with TLS 1.3. There is no WebSocket path, no fallback, and no downgrade in any product build configuration.
Trust before credentials
Credentials are never sent until certificate trust is resolved. An attacker who fails the trust check receives nothing, because nothing has been transmitted.
Connection flow
The Pier must have a valid certificate before it listens. The operator can provide one that chains to internal PKI, or Pier can generate a self-signed leaf on first start. Arcen operates no root CA and no certificate issuance service. Invalid certificate setup fails closed and is logged locally.
The user enters the Pier address in Deck.
Deck opens a QUIC connection. TLS 1.3 is integral to the handshake. No application data moves before the handshake completes.
Deck validates the full chain against trust anchors you control. A broken, expired, or untrusted chain terminates the connection before authentication. There is no prompt and no override. This closes the interception gap on the first connection because the user does not decide trust.
A self-signed certificate has no chain to validate. Deck shows its SHA-256 fingerprint on first connection and pins it after explicit acceptance. Later matches proceed silently. A changed certificate is a hard refusal with no prompt or click-through.
The self-signed first connection remains exposed unless the operator verifies the fingerprint out of band. Organisations with internal PKI should provide their own certificates; this removes the first-contact exposure.
Credentials move only over the encrypted, pinned channel. Linux Piers authenticate through PAM. Windows Piers use the Credential Provider path to an interactive session. Arcen stores no password, hash, or credential of its own.
Valid credentials open a session. Invalid credentials produce no session and no distinguishing network response: wrong password, unknown account, and disabled account look the same from outside. Pier logs the full detail locally. Opacity is owed to the network, not the machine administrator.
Rust and architecture
Arcen is native Rust throughout, across hosts and client. unsafe is forbidden in the shared protocol crate.
Every Pier and Deck speaks the on-wire contract from one shared crate, preventing client and host from drifting into different protocol interpretations.
Separate platform crates use the strongest capture, encode, decode, and render path available to each operating system and GPU.
Damage tracking
Arcen tracks changed screen regions on a 16×16 grid and uses that map to skip conversion work on unchanged content. The engine is a shared pure component, currently applied to skip clean rows during colour-space conversion on Windows Media Foundation hosts.
Licensing
Current trial and annual node-locked entitlement is tied to the Pier workstation's HostID. Verification has no runtime network dependency. Authentication and licensing complete on an isolated network with no route to the internet.
Planned RLM floating licensing will also run offline. Each Pier will point to a customer-hosted licence server.
What Arcen is not
Arcen stays narrow so control remains with the operator.
Arcen issues no accounts, stores no passwords, and holds no credential of its own. Access is granted and revoked through the workstation account system you already run.
Arcen operates no root CA and issues nothing on your behalf. Pier honours your certificates; when it generates one, its private key never leaves the machine.
No session, authentication step, or licence check depends on reaching Arcen or the internet. Arcen will not become a cloud service.
No Arcen-operated system sits between a user and a workstation. There is nothing upstream to compromise because there is no upstream.
This page separates current implementation from specified and roadmap work. It does not claim certification, regulatory approval, compliance, or suitability for a specific classified environment. Production availability remains subject to release signing, target-native validation, and published support requirements.
Product overview
See the deployment choices, use cases, pricing, and funding roadmap.
Back to overview