The architecture, written like a researcher writes it.

Every redaction product makes a trust claim. This page is where we show our work: exactly what is logged, what is not, how data moves through the system, and what happens at every step. It will be kept current as the system evolves — this is a living document, not a marketing page.

Zero retention is the standing commitment

Files and text are processed in memory and destroyed. No PII is stored server-side, and nothing is ever used for training. Only non-PII metadata (timestamps, entity counts, durations) is logged for the audit trail. The processing pipeline is designed so that a breach of the platform yields no customer content — there is nothing to exfiltrate.

What we log (and what we refuse to log)

• Logged: request timestamps, entity counts, processing duration, error codes. Counts and metadata only — never content.
• Never logged: document contents, extracted text, entity values, placeholders, or any mapping between them.
• Retention: files and text are processed in memory and destroyed — nothing is retained.

How data moves

Text and files are processed in memory by the detection engine in an isolated container. The verified output is returned to the caller; nothing is stored between jobs. The engine speaks JSON in and out — no persistent state between jobs.

Fail-closed verification

The export pipeline re-runs detection on every output file. If any detected entity survives, the export fails closed — no partially redacted file ever leaves the system. Copy-paste, metadata, and programmatic text extraction are all tested as part of the release gate.

The threat model, honestly

The primary risk to a redaction product is a leak: a single missed entity in an exported file. That is why correctness is the product, not a feature. The secondary risk is platform compromise; zero retention is the mitigation, because there is nothing to take. We apply WAF rules, rate limiting, and least-privilege infrastructure as baseline posture.

Built by a researcher

The detection engine is informed by the same research published at cctbp.com and the open-source FlawedToken lab — a practitioner's understanding of where identity artifacts actually hide in real systems.