Written for IT and security teams, for the privacy officer, and for whoever runs a procurement file. None of these checks asks you to trust this website: ask us for the module and your team runs them in an afternoon.
Until July 2026 the engine really did run on the home page. We took it out on purpose, and the reason is worth knowing: a public demo that answers is a way to extract from a detector how it decides — one query a second, all night, without opening a single file. The home page demo is now a recording of real runs. The engine we hand to you, and probing it at your place is your business.
Built. Testable today.
Compiled from Rust to native code and to WebAssembly. No randomness, no model weights and no sampling: the same input, with the same session state, gives the same output. No AI model takes part in detection. The only thing carried across is session memory, which re-masks a name already identified in that same conversation and which the calling application can clear.
We are not promising it calls nowhere: there is not one line inside the engine capable of opening a connection. A WebAssembly module can only call what it is handed, and this one is handed nothing: it cannot open a socket, read a file, or look at the clock. Drop the module we send you next to any page you have open and paste this into that console:
const path = './nonimo_core.wasm'; // the file we send you
const bytes = await (await fetch(path)).arrayBuffer();
const m = await WebAssembly.instantiate(bytes, {});
console.log(WebAssembly.Module.imports(m.module));
// → [] the import list is emptyIt is the first check we would run ourselves if we were reviewing someone else's product, and it takes a minute.
Anything with a check digit — ABN, Medicare number, IBAN — is cleaned silently. Anything found by position or by the words around it — names, addresses, matter numbers — is masked in the open, with the reason in one line and one click to undo it. By default nothing is removed silently without arithmetic proof. Two things can change that, and you decide both: the terms you load, and the policy step your IT picks — there are five, from observe to block.
We ship no dictionary of first names or surnames. Names are found by their position: the form label, the signature block, the courtesy title before a surname, the column of a table. That way coverage does not depend on how common a name is, which is exactly where lists and models fail. The only list involved is yours: your clients and your matters, loaded by you, compared on your machine, and never reaching us.
Built. This is the whole inventory.
The engine writes nothing to disk: it has no file access, and the module we hand you declares no imports at all. What it does do is hand back the conversation as bytes when the application asks for them. Saving those bytes is the application's job, and both desktop apps save them. So here is the whole of it.
The map that puts masked values back, the per-category counts, the names that conversation had already recognised, the terms it learned along the way, and the language it minted its markers in.
And on your own vocabulary the precision has to be made platform by platform. The list you load is not copied in — the saved file has six fields and none of them is the dictionary. But the terms from that list which appear in the conversation do end up inside, like any other masked value. That happens on Windows today; on the Mac it does not, and not by design but because the Mac app does not load any vocabulary of its own yet.
| Mac | Windows | |
|---|---|---|
| Where | Inside Application Support, in a folder with 0700 permissions | Under LocalAppData |
| Under what | AES-GCM, under a key derived from the Secure Enclave | User DPAPI |
When: every time the application masks something, and on closing it. Putting the names back does not write again, and neither does anything once the month's allowance is spent.
In that same folder sit the Mac's key and both apps' temporary files. And one folder up, a second, unencrypted file holding the running totals per category — category names and numbers, never anyone's values. It sits up there on purpose: precisely so that neither “Clear everything” nor the thirty-day sweep takes it away, because without those totals a label already handed out could come to mean a different person.
There too they differ: the Mac stores those names behind a hash salted per installation, and Windows leaves them readable. And we say how far that hash goes, because promising more would be easy: the salt sits on the first line of that same file, and the possible categories are a closed catalogue of thirty-three, so anyone holding the file recovers the names by trying all thirty-three — which is what the application itself does to read it. The salt keeps two installations from being compared with each other; it does not keep whoever opens the file from understanding it.
And the number does not count people: it is a floor, the number below which that category no longer hands out. In steady state it matches the highest marker it handed out; but if the application loses its history, all thirty-three jump at once to the same number, which can sit far above anything anyone ever used. That is why it cannot be read as a count of anything.
A saved conversation stops being openable after thirty days without a save, and the date is one for the whole file: a save today puts today's date on things that have been inside for months. But it is not the same window on both.
On Windows it is an opening window and nothing more: the expired file stays on disk, encrypted, until a later save overwrites it — and what expires is the date, not the file, because the comparison is against the machine's clock.
On the Mac it is both: it stops opening and the start-up sweep deletes it, counted from the file's last write rather than the date it carries, so it can disappear a little earlier there. Our own internal checks use twenty-nine days for exactly that reason.
The window only covers the conversation. The per-category totals and the preferences carry no date and expire on neither platform. The settings-change history does carry the date and time of each change — that is what it is for — and does not expire either. And the usage counter carries the current month and resets monthly.
| Mac | Windows | |
|---|---|---|
| Automatic cleanup | Deletes what has expired the next time Nonimo opens, before it opens anything. There is no background sweep: for an app that is never reopened, nothing ever expires off the disk | None. Nonimo no longer opens an expired file, but it stays there until a later save overwrites it |
| Delete button | “Clear everything” in settings. Asks the system to remove the file and reads what the system answers: if the delete does not go through, it does not say “Deleted” — it says “Partly deleted”, stops the file opening by changing the seal from outside, also tries to empty it to zero bytes, and shows you the folder | None today. Closing the application saves; it does not delete |
| Backups | Excludes the conversations folder and the totals file from Time Machine | No equivalent attribute: a disk clone or a block copy of the profile takes them along |
“Clear everything” removes the conversation, and only that: the key and the totals file stay on purpose.
| Against | Mac | Windows |
|---|---|---|
| A program running in that person's session | 🔴 Neither protects: it can decrypt the file | |
| Whoever administers the machine | 🔴 No: with admin rights you reach the key, and the chip unwraps it just the same | 🔴 No: whoever gets to administrator gets to that account's credential |
| Another account without privileges | ✅ Yes, through permissions (0700 the folder, 0600 the files) | ✅ Yes, through the encryption itself: DPAPI is tied to the account credential, and being able to read the file is not enough |
| Taking it to another computer | ✅ Will not open: the security chip ties the key to the Mac that created it | ⚠️ The file alone will not open, but a disk clone or a copy of the whole profile takes the credential too — and then it does |
conversacion.nonimo.rescatado, which deletes nothing today and has to be
removed by hand.
The compliance panel does write the counts it receives to disk, because that is where the monthly report comes from — on your server and with the retention period you set.
The engine and the desktop app exist on both platforms — the Mac build signed with an Apple Developer ID and notarised, the Windows build signed too. What follows covers the personal app and the team version, and you can hold us to every line of it.
There is no account, and the only place we ask for your email is the free licence page — and, later, payment. The application itself never asks. Detection does not need to reach any server of ours, not even to update its rules, and that is worth checking rather than believing: the engine has no network code to do it with.
What the outer application sends, once a day, is a usage count: how much of the month's allowance is spent, how much of that was documents and how much pasted text, versions and platform, and an installation number generated on the machine itself. Not one word of your text and not one term from your dictionary. The full list is on the privacy page.
The daily count cannot be switched off from inside the app, and the way to object is to write to us. macOS builds up to 0.1.6 still carry the checkbox in Settings; it disappears on update, and what this site gives you today is a later build on both platforms.
The application asks this site whether there is a newer version. On macOS that request
is not anonymous — we would rather write that than leave a tidier sentence: it carries
your version and your system, in a single header and nothing else, with no installation
number, no parameters in the address and no cookies. The Windows build sends no
User-Agent header at all, so there the request is just an IP asking for a
public file.
With no network, or with our server down, it keeps masking against a local counter. If the server were essential, a failure of ours would leave everyone unprotected.
It says, for example, that something shaped AAA-9999-99999 appeared 37 times
after the word “order”: letters become A, digits become 9. Three locks: the value does not
travel, no word travels that we did not put there ourselves, and there is a repetition
threshold below which nothing is noted. The engine does not send the report, it only
prepares it. The outer application would send it, with permission, and it ships off.
A panel event carries five fields: date and time, device identifier, per-category counts, policy version and action taken. Not the text, not the values, not the destination address, and not what the person typed into the AI tool. Whether that identifier can be tied to a named person is your call at rollout: pseudonymous by default.
How it installs and, above all, what it does not do — so your IT can assess it before rolling it out.
Recording what staff paste into AI tools is workplace surveillance, and it is regulated. In Australia the rules are state by state: New South Wales requires 14 days' written notice before computer surveillance under the Workplace Surveillance Act 2005; the ACT has its own regime; Victoria has no dedicated workplace surveillance act today, and a 2025 parliamentary inquiry has recommended one.
That obligation is yours, not ours, but discovering it late kills the deployment, so we would rather raise it before you buy than after. Nonimo is designed to make that argument easier: the panel receives counts and not text, it does not see what the person wrote, and the device identifier can stay pseudonymous. You can show the control was in place without reading anyone's work.
You do not have to draft that notice yourselves: it ships with the deployment documentation, alongside the internal policy template.
Checked against the deployed site.
A product that exists to stop other people's data escaping has to apply the same rule to itself, so this is a fair test — and here is how to run it.
Not report-only, with no wildcards and no third-party hosts. These are the eleven the header
serves: default-src 'self', script-src 'self',
style-src 'self' 'unsafe-inline', img-src 'self' data:,
font-src 'self', connect-src 'self' https://api.nonimo.ai,
object-src 'none', frame-ancestors 'none',
base-uri 'self', form-action 'none' and
upgrade-insecure-requests.
The only script origin allowed is this domain, and the only place a page can open a
connection to — even if someone managed to inject code into it — is
api.nonimo.ai, our own server, there so the licence page can talk to it.
style-src allows inline styles, because our build inlines the stylesheet into the page itself.img-src also allows data: URIs, none in use today, in case an inline icon ever arrives.connect-src names https://api.nonimo.ai, because the licence page sends an email address to it. Our server, not a third party.
They are real relaxations and you will find them anyway: better that we tell you. Until
July 2026 there was a fourth, 'wasm-unsafe-eval', which the live demo needed;
it left with the demo.
X-Frame-Options: DENY and frame-ancestors 'none', both at the
same value, because this site is embedded nowhere. Plus Permissions-Policy
denying camera, microphone, location and payments, which we do not ask for and will not.
nosniff and strict-origin-when-cross-origin are sent by
Cloudflare Pages on its own; we checked that before we stopped writing them ourselves, so
as not to end up with the same header twice.
No page on this site loads anything that does not come from this domain, which is why there is no cookie banner. The only page that opens a connection outside its own document is the licence page, and it goes to our own server.
And one caveat, named by us — you will find it in ten seconds with the same header
checker we are suggesting: our host adds NEL and Report-To headers
to its responses, asking the browser to report a connection failure to the host's own
telemetry endpoint. Those reports only exist when the network fails, and they carry nothing
you write and nothing from the page.
There are no analytics: our host offers a free, cookieless one and we said no, because turning it on brings in a script from another server — which is exactly what this page promises we do not do. You do not have to take our word for it: run a header analyser over it and compare the result with any other security product you are looking at.
There is no single honest number. Detection quality is measured against real public documents — official gazettes, tribunal decisions, government forms — separately for each language, because a figure measured in Spanish says nothing about English. Ask us for the current ones, with the corpus and the date they were taken, and we will send them without putting you through a sales call.
Better still, ask for the module and run your own documents through it on your own machine — a published decision, a blank form, a closed file. That is the measurement that counts, because it is your paper and not ours, and neither the document nor the result comes anywhere near us.
None, and we are not going to pretend otherwise. No ISO 27001, no SOC 2, no IRAP assessment. We are a new company and ISO 27001 costs more than we have. What we do instead: the engine was reviewed line by line in July 2026, adversarially, by us — which is not an independent audit and we are not going to call it one; we will answer any security questionnaire you send us, in your format; and we will hand your team the engine to review, which is a real offer and it is at the bottom of this page. If a certification is a hard requirement for you, tell us now and we will tell you honestly whether we can get there in your timeframe.
Nonimo is new and nobody is running it in production yet. When someone is, we will ask them before we say so.
And this is not legal advice. It describes how the product is built and what obligations deploying it triggers, so your privacy officer and your advisers can decide with the facts in front of them. You are the ones who sign.
Security questions, or want your team to review the engine? Write to hello@nonimo.ai. The engine review is a real offer: we hand it over for you to read.
Found a vulnerability? Write to the same address. We acknowledge within two business days and tell you what we will do and when. We will never go after anyone reporting in good faith, and if you want the credit, you get it. If there were ever an incident affecting you, we tell you within 24 hours of knowing — under 24 and not 72 on purpose: your own notification deadline is yours, and you need room inside it.
Last reviewed: 24 September 2026. When the product changes, the page and the date change.