Security
ARROW Decrypt Security
Section titled “ARROW Decrypt Security”ARROW Decrypt handles some of the most sensitive material on any engagement: password hashes going in, and recovered credentials coming out. It is built for authorized password audits only, and its handling of that data is deliberate. This page covers how it protects what you feed it. For platform-wide protections, start with Security.
Your data stays in your cluster
Section titled “Your data stays in your cluster”The hashes you load and the passwords ARROW Decrypt recovers stay within the cluster you operate. When ARROW Decrypt reports up to the ARROW Console, it sends status only: fleet health, job progress, and counts. It never sends your hashes, your recovered passwords, or your wordlists. The Console is a place to see that a cluster is working, not a copy of what it is working on.
Sensitive data is kept separated and scoped
Section titled “Sensitive data is kept separated and scoped”The way data is handled inside ARROW Decrypt limits the damage a single leak could do:
- Usernames are separated from hashes on the way in, so a hash on its own does not carry the identity it belongs to.
- Every recovered password is scoped to the engagement it came from, not pooled into one shared bucket, so results stay tied to the authorization that produced them.
Access is controlled and verified
Section titled “Access is controlled and verified”Reaching ARROW Decrypt is role-based, the same as the rest of the suite: your role decides what you can see and do. Each account can add two-factor authentication on top of its password, and an administrator can require it. See Account & Security for setting up your own login and turning on two-factor.
Everything is audited
Section titled “Everything is audited”Every action in ARROW Decrypt is written to an audit log: which hashes were loaded, which jobs ran, what was recovered, and who exported it. For work that has to stand up to a client’s review, that trail is what lets you show exactly what was done and by whom.
What to watch for
Section titled “What to watch for”- Only load hashes you are authorized to audit. ARROW Decrypt assumes the work is authorized; that authorization is yours to hold.
- Turn on two-factor. Add it to your own account even if it is not required yet. See Account & Security.
- Handle exports carefully. A recovered-password export is as sensitive as the credentials themselves. Store it and share it accordingly, and delete it when the engagement is closed.