For the security team. Everything your CISO will ask about.
Zero network egress
The AI model (DistilBERT fine-tuned for NER, dslim/distilbert-NER, ~250MB) runs locally via WebAssembly. During processing, zero outbound requests. Verify: open DevTools → Network tab.
Verifiable DistilBERT
End-to-end encryption
AES-256-GCM via SubtleCrypto API. Keys are non-extractable — JavaScript cannot read them. They exist only in hardware.
SubtleCrypto
Forward secrecy
Each session derives unique HMAC keys from a master key via HKDF-SHA256 with session-specific context. Sessions are cryptographically isolated — audit entries from a prior session cannot be verified under a new session's key. Sessions expire after 1 hour; re-authentication required.
HKDF-SHA256 Session isolation
Memory clearing
After every operation, plaintext is overwritten with a 3-pass NIST SP 800-88 compliant sequence. XOR bit-difference verification confirms the wipe.
NIST SP 800-88 Compliant
Tamper-evident audit
Every step — encrypt, decrypt, infer, wipe — is logged to an HMAC-SHA256 chain. Export as JSON or CSV for regulatory compliance.
HMAC-SHA256
Bounded plaintext window
Decrypted data cannot exist in memory beyond a configurable T_max. If exceeded, emergency wipe triggers automatically.
T_max enforced
Browser isolation
Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) headers prevent Spectre-class side-channel attacks. WASM runs in a sandboxed execution environment.
COOP/COEP
Side-channel mitigations
Sensitive comparisons use constant-time operations (bitwise, branch-free) to prevent timing side channels. Memory fences around wipe passes prevent compiler or CPU reordering. Saturating bounds checks on user-controlled indices mitigate Spectre-style speculative execution attacks. Sensitive key material is stored on 64-byte cache-line aligned buffers.
Constant-time Cache-aligned Spectre mitigation
PDF output construction
Redacted PDFs are built from scratch via new jsPDF(). The original file's bytes are never copied — only the extracted, NER-processed, redacted text is rendered into a fresh document. No author metadata, XMP streams, revision history, or embedded scripts carry through. Coverage note: extraction reads the document's text layer, comments, and form fields, and standalone image files are run through OCR — but text inside images embedded within a document is not OCR'd in place and will pass through unredacted. Extract such images as separate files to redact them.
Zero metadata carry-through Embedded-image caveat
Reversible tokenization
Alongside static redaction, entities can be replaced with reusable tokens — [NAME_1], [EMAIL_1], [PHONE_1]. The tokenized text can be pasted into an external AI tool; the tool's response is then run through the local Reveal map, which restores the original entity values. The reveal map never leaves the browser and is discarded when the session ends.
Reveal map, client-side only
Profile auto-detection
Content patterns in the input — MRN numbers, IBANs, CVE identifiers, case numbers, APT indicators — select one of nine regulatory profiles (healthcare, financial, legal, legal_strict, cybersecurity, content_moderation, government, communication, default). Each profile sets a different T_max plaintext memory window. The detection runs entirely in the browser as deterministic regex matching against the extracted text, and the selection can be overridden at any time via the T_max dropdown.
Continuation patent 19/636,972
Permanent redaction, real text
Redacted documents are generated as new files — original text is never present in the output. No hidden layers, no recoverable data. Unlike pixel-burn approaches, output remains searchable and accessible — because it's real text, not a flattened image.
New file generation