Arkeion ἀρχεῖον

Sovereignty

Why Arkeion can be defended as genuinely European in front of the public sector and regulated industries — and where the honest limits of that claim lie. The word “sovereign” is worn thin by marketing; this page is about the version of it that survives a tender question or an audit.

The claim, on three planes

The sovereignty that actually gets assessed operates on three planes at once. A product is only as sovereign as its weakest plane, and Arkeion controls all three.

The engine from scratch in Rust — no SQLite lineage, publicly specified format The entity owned & governed under a European group — EU jurisdiction, no foreign CLA The data one file, optionally encrypted under your key — no telemetry, no phone-home
A weakness on any one plane sinks the claim. Arkeion is designed so all three hold.
  • The engine. Written from scratch in Rust. Not a line, not the file format, not the journal model derives from SQLite or any US-based engine. The format is publicly specified, so a third party can implement an independent reader — the strongest possible answer to “what if you disappear?”
  • The entity. Ownership and governance sit under a European group (Syrakon). Roadmap, licensing, and security decisions are made under EU jurisdiction, with no contributor licence agreement assigning rights to a foreign entity.
  • The data. A single file under the operator’s physical control, optionally encrypted with AES-256-GCM under a key the operator supplies at creation time. No telemetry, no mandatory cloud, no “phone home”. EU data residency becomes a deployment property the design never works against.

Why not a fork

Forking SQLite or libSQL would have been faster. It was ruled out deliberately.

  • Technical inheritance is governance inheritance. A fork inherits the format, the decisions, and the debt of a project whose centre of gravity is American. The European story then collapses to “maintained in Europe” — which does not survive scrutiny.
  • The differentiators don’t fit inside SQLite. Time-travel, branching, and the hash chain require append-only, copy-on-write storage. Bolted onto SQLite’s format they would be fragile patches; in Arkeion they fall out of the design.
  • Auditability is a feature. Roughly ~15k lines of Rust (approximate) written to be read are worth more to an auditor than ~150k lines (approximate) of inherited C carrying decades of special cases.

Compliance by design

Each regulatory requirement maps to a concrete mechanism in the engine — not a policy promise bolted on top, but a property of how the file works.

Requirement Arkeion mechanism Data at rest (GDPR) page-level AES-256-GCM, your key Retention vacuum — global retention frontier Evidentiary integrity hash chain — tamper is detectable Change traceability time-travel — query any version Migration reversibility branch · diff · merge or discard Supply-chain audit 4 runtime deps, pure Rust, vendored
Compliance requirements aren't answered with a document — they're answered with the file format.
Requirement How Arkeion answers it
Data at rest (GDPR) Page-level AES-256-GCM, opt-in at file creation, embedded use only — with a key set, neither schema nor data sits in the clear. A database served by arkeiond is not encrypted at rest today.
Retention and minimisation vacuum with a retention policy physically drops pruned versions from the file. The frontier is global, not per subject — erasing one data subject takes schema design, not a purge command. See GDPR.
Evidentiary integrity (healthcare, public administration) A global hash chain: altering the past breaks the chain, detectably.
Change traceability Native time-travel: the state at any version or point in time is queryable.
Migration reversibility Branching with diff and merge: trial a change, review it, then merge or discard.
Supply-chain audit Four runtime dependencies, pure Rust, vendored; everything else is hand-written.

The honest limits

Saying these out loud, before someone else finds them, is what separates a serious position from sovereignty-washing.

  • Erasure. Retention is a global frontier, not a per-subject purge: removing one person’s history discards everyone else’s below the same line. The schema pattern that works is in GDPR.
  • Tamper-evidence, not tamper-proofing. The hash chain is unkeyed: whoever holds the file can rebuild it from genesis and pass verify(). It detects alteration by anyone without the file — an anchor you store elsewhere is what extends that to us.
  • At-rest encryption is embedded-only. arkeiond takes no key, so a database served over the network is plaintext on disk today.
  • Toolchain. Rust and LLVM are global projects with foundations based in the US. No sovereign compiler exists — nobody in the industry has one. What is controlled is the auditable source that goes into the compiler.
  • Cryptography. RustCrypto is a decentralised, internationally-audited community rather than a US company. Even so, the engine consumes it behind a CryptoProvider trait: if a certified European backend appears (BSI, ANSSI, CCN), it plugs in without touching the format or the engine.
  • “Made in Europe” here means design, implementation, governance, format specification, and data custody under European control. It does not claim every transistor or every line of the toolchain is European — and saying so plainly is the point.

Alignment with EU strategy

  • Open Source. Genuinely open, OSI-approved dual licensing (MIT or Apache-2.0), a public format specification, and no lock-in — the format is specified, so your data comes out by SELECT, by DDL schema dump, or by copying the file. A CSV/JSON/SQL export command is still to come.
  • Technological sovereignty. Arkeion sits in the data-infrastructure layer that is made in Europe, for Europe: a natural fit for European open-source adoption and funding programmes.