For the security team. Everything your CISO will ask about.
Zero network egress
The AI model (DistilBERT fine-tuned for NER, dslim/distilbert-NER, ~250MB) runs locally via WebAssembly. During processing, zero outbound requests. Verify: open DevTools > Network tab.
See a red CSP error in the console? That's our Content-Security-Policy blocking a script injected by our own CDN. Nothing runs in this page that we haven't signed, not even Cloudflare's.
Verifiable DistilBERT
End-to-end encryption
AES-256-GCM via SubtleCrypto API. Keys are non-extractable, JavaScript cannot read them. They exist only in hardware.
SubtleCrypto
Forward secrecy
Each session derives unique HMAC keys from a master key via HKDF-SHA256 with session-specific context. Sessions are cryptographically isolated, audit entries from a prior session cannot be verified under a new session's key. Sessions expire after 1 hour; re-authentication required.
HKDF-SHA256 Session isolation
Memory clearing
After every operation, plaintext is overwritten with a 3-pass NIST SP 800-88 compliant sequence. XOR bit-difference verification confirms the wipe.
NIST SP 800-88 Compliant
Tamper-evident audit
An HMAC-SHA256 chain covers the whole session from first page load: verified model delivery, encrypt, decrypt, infer, wipe, and a record for every detection stage. One click exports the evidence, an ECDSA-signed JSON audit trail, CSV, and the redaction map, plus a signed compliance certificate built only from what the session actually observed. A third party verifies all of it offline with standard tools. The evidence bundle carries the temporal anchor described below, and the compliance certificate includes it as one of its checks.
HMAC-SHA256 + ECDSA-P256
Attested supply chain
The WASM engine and the model manifest each carry an ECDSA-signed attestation that the browser verifies against a pinned key before anything runs, and every model shard is SHA-256-verified before use. Any mismatch fails closed, and every verification is recorded as an audit event.
Fail-closed attestation
Anchored in time
The origin of the chain binds an externally attested time value, read from the response that delivers the model, so obtaining it sends nothing. A verifier who trusts whoever issued that value learns that the records cannot predate it. The head of the chain is committed as a digest only, and each session's origin commits to the previous session's head, so a session removed from a set is detectable. The exported evidence bundle names the anchoring mode in force. Having that head digest timestamped externally, which adds the matching latest bound, is available to a deployment rather than automatic.
Patent pending
Bounded plaintext window
Decrypted data cannot exist in memory beyond a configurable T_max. If exceeded, emergency wipe triggers automatically.
T_max enforced
Browser isolation
Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) headers prevent Spectre-class side-channel attacks. WASM runs in a sandboxed execution environment.
COOP/COEP
Side-channel mitigations
Sensitive comparisons use constant-time operations (bitwise, branch-free) to prevent timing side channels. Memory fences around wipe passes prevent compiler or CPU reordering. Saturating bounds checks on user-controlled indices mitigate Spectre-style speculative execution attacks. Sensitive key material is stored on 64-byte cache-line aligned buffers.
Constant-time Cache-aligned Spectre mitigation
PDF output construction
Redacted PDFs are built from scratch via new jsPDF(). The original file's bytes are never copied — only the extracted, NER-processed, redacted text is rendered into a fresh document. No author metadata, XMP streams, revision history, or embedded scripts carry through. Coverage note: extraction reads the document's text layer, comments, and form fields, and standalone image files are run through OCR — but text inside images embedded within a document is not OCR'd in place and will pass through unredacted. Extract such images as separate files to redact them.
Zero metadata carry-through Embedded-image caveat
Reversible tokenization
Alongside static redaction, entities can be replaced with reusable tokens, [NAME_1], [EMAIL_1], [PHONE_1]. The tokenized text can be pasted into an external AI tool; the tool's response is then run through the local Reveal map, which restores the original entity values. The reveal map never leaves the browser and is discarded when the session ends.
Reveal map, client-side only
Profile auto-detection
Content patterns in the input, MRN numbers, IBANs, CVE identifiers, case numbers, APT indicators, select one of nine regulatory profiles (healthcare, financial, legal, legal_strict, cybersecurity, content_moderation, government, communication, default). Each profile sets a different T_max plaintext memory window. The detection runs entirely in the browser as deterministic regex matching against the extracted text, and the selection can be overridden at any time via the T_max dropdown. The selection and the content signals that drove it are themselves recorded in the audit chain.
Continuation patent 19/636,972
Permanent redaction, real text
Redacted documents are generated as new files, original text is never present in the output. No hidden layers, no recoverable data. Unlike pixel-burn approaches, output remains searchable and accessible, because it's real text, not a flattened image.
New file generation