How it stays sealed

Deterministic conversions run in this browser tab

PDF, Word, Markdown, HTML, CSV, TSV, JSON and Excel round-trips are computed in your browser. These jobs prepare no AI request body. The Request body receipt shows that status; it does not measure other browser traffic or bytes received by a server.

AI-assisted conversions relay a cloaked copy

When you ask AI to restructure or summarise a document, its text is cloaked on your device first: every identifier the engine detects — emails, phone numbers, dates of birth, cards, IBANs, passports, national and company IDs, IP addresses, postcodes, places, and person names (on-device dictionary, a ~25 000-name gazetteer, and a multilingual name model that runs in this tab) — becomes a realistic surrogate. The cloaked copy of the document text is what goes to the CloakAPI gateway; the reply is mapped back locally. Detected values were replaced before sending; the map that restores them stays on this device. You can still send while the name model is missing. Quick check replaces values it recognises; some names may be sent as written.

The relay is fail-closed

In this app's normal client flow, the SDK tokenises the AI request before sending and stops when a required detector cannot load. Our server checks the supplied privacy-engine version and fingerprint, sends the exact request to the CloakAPI gateway for a check, and then forwards it to the AI service. This check does not prove on-device tokenisation. Known limit in Release 1: a caller on this same origin can bypass this page and submit text without client-side tokenisation. Detected values are replaced with surrogates; values the engine misses may remain as written.

A Request body receipt on every job

For AI-assisted conversions, the receipt shows scan results and the UTF-8 byte length of the exact JSON request body this browser posted to the same-origin relay. It includes instructions, cloaked document text and request metadata, but excludes HTTP headers and transport bytes; it does not measure bytes received by the gateway. Deterministic conversions show that no AI request body was prepared.

The boundary is enforced by the browser

Every page ships a strict Content-Security-Policy. The only off-origin destinations the browser will even permit a connection to are the CloakAPI gateway and your account — a fetch, XHR, WebSocket, image or script request to anywhere else is refused, so a bug or a bad dependency can't quietly phone home:

connect-src 'self' https://api.cloakapi.io https://app.cloakapi.io

This is delivered as a real policy, not a promise. The egress meter counts request activity by destination; it does not report byte totals. The page downloads its detection models from this site once (about 181 MB for Level 2, about 176 MB for Level 3). api.cloakapi.io handles AI relays and request checks; app.cloakapi.io serves account and billing flows.

What we can and can't claim

• We can say: deterministic conversions build the output in this browser tab without preparing an AI request. On an AI-assisted job, the engine replaces detected values in the cloaked document text before it is prepared for relay. The Request body receipt counts UTF-8 bytes in the exact JSON body this browser posted to the same-origin relay and reports scan results; it excludes HTTP headers and transport bytes and does not measure bytes received by the gateway.
• We won't say: that detection is complete. Structured identifiers — emails, phone numbers, dates of birth, cards, IBANs, passports, national/health/company IDs, IP addresses and postcodes — are deterministic and high-coverage. Person names are matched against an on-device dictionary, a ~25 000-name gazetteer, and a multilingual name model (multilingual BERT NER, about 181 MB, plus a larger model for non-Latin scripts) that runs in this tab — uncommon and non-Latin-script names are in scope. Detection is still not omniscient: an identifier none of the layers recognise can slip through. Organisations are recognised by a legal suffix (Ltd, GmbH, AS, Inc…) plus the on-device model, so a single-word company name can still be missed. Street addresses are matched in US number-first order, so a European “Storgata 14” style address is not detected as an address at all. On an AI-assisted conversion, anything not detected is relayed as written — read the Request body receipt, and use a deterministic on-device conversion if that matters for your document.

What about scanned images and OCR?

On-device OCR isn't available yet, so an image-only (scanned) PDF is refused before an AI request is prepared; no cloud OCR service is used. Text-based PDFs, Word docs and the data formats all convert on-device today.