Security, in checkable claims

This page is written for IT and security reviewers. Every claim below is verifiable — most of them in the live demo with your own network inspector open.

The engine

One deterministic engine, compiled from Rust to native code and WebAssembly. Same input, same output, every time. No AI model is involved in detection.
It has no network code. Not “it doesn’t phone home” — there is no code in the engine capable of opening a connection. The demo on this site runs the real engine in your tab: watch the network tab while you use it.
It writes nothing to disk. The map that restores masked values lives in memory, owned by the calling application, cleared when the conversation ends.
Detection is layered by proof. Identifiers with check digits (tax file numbers, Medicare, IBAN, national IDs) are cleaned automatically. Everything found by position or wording — names, addresses, case references — is masked visibly, with a one-sentence reason, and is reversible in one click. Nothing is silently removed without arithmetic proof.
No lists of names. Names are found by their position — the form label, the signature, the title before a surname — so coverage does not depend on how common a name is or where it comes from.

What leaves each computer

In the free app: nothing. There is no account, no telemetry, no update-server dependency for detection.
In the team version: counts and categories. The compliance panel receives events like “3 person names, 1 Medicare number, masked, policy v4” — never the text, never the values. The panel is installed on infrastructure you or your IT provider manage.
The optional coverage report is shapes, not values. To improve detection, the app can report that something shaped like AAA-9999-99999 appeared 37 times after the word “order” — the letters become A, the digits become 9, and any word not on our own built-in list never travels. It is off by default.

Deployment surface

Browser extension deployed by policy (Chrome, Edge). No SSL interception, no proxy, no traffic capture.
Desktop app without kernel drivers or system extensions.
Panel as a container on your infrastructure. We have no access to it.

What we will not claim

We do not claim a percentage. Detection quality is measured against real public documents (official gazettes, tribunal decisions, government forms) and those measurements drive development. Ask us for the current numbers — or paste your own redacted document into the demo and see for yourself.

Security questions, or want the engine reviewed by your team? hello@nonimo.ai