The architecture, written like a researcher writes it.

Every redaction product makes a trust claim. This page is where we show our work: exactly what is logged, what is not, how data moves through the system, and what happens at every step. It will be kept current as the system evolves — this is a living document, not a marketing page.

Zero retention is the standing commitment

Files and text are processed in memory and destroyed. Nothing is stored, nothing is written to durable logs, and nothing is ever used for training. The processing pipeline is designed so that a breach of the platform yields no customer content — there is nothing to exfiltrate.

What we log (and what we refuse to log)

• Logged: request timestamps, entity counts, processing duration, error codes. Counts and metadata only — never content.
• Never logged: document contents, extracted text, entity values, placeholders, or any mapping between them.
• Retention: processing infrastructure holds uploads for a maximum of 24 hours under an automatic lifecycle rule, then destroys them.

How data moves

Uploads go to object storage via presigned URLs with a 24-hour lifecycle rule. A job is queued to the detection engine, which processes the document in an isolated container. The verified output is returned to the caller; the container and its storage are destroyed. The engine speaks JSON in and out — no persistent state between jobs.

Fail-closed verification

The export pipeline re-runs detection on every output file. If any detected entity survives, the export fails closed — no partially redacted file ever leaves the system. Copy-paste, metadata, and programmatic text extraction are all tested as part of the release gate.

The threat model, honestly

The primary risk to a redaction product is a leak: a single missed entity in an exported file. That is why correctness is the product, not a feature. The secondary risk is platform compromise; zero retention is the mitigation, because there is nothing to take. We apply WAF rules, rate limiting, and least-privilege infrastructure as baseline posture.

Built by a researcher

The detection engine is informed by the same research published at cctbp.com and the open-source FlawedToken lab — a practitioner's understanding of where identity artifacts actually hide in real systems.