How it stays sealed

Deterministic conversions never leave the tab

PDF, Word, Markdown, HTML, CSV, TSV, JSON and Excel round-trips are computed entirely in your browser. Zero bytes are uploaded. The egress monitor stays SEALED — cross-check it against your own Network panel.

AI-assisted conversions relay a cloaked copy

When you ask AI to restructure or summarise a document, its text is cloaked on your device first: every identifier the engine detects — emails, phone numbers, dates of birth, cards, IBANs, passports, national and company IDs, IP addresses, postcodes, places, and person names (on-device dictionary, a ~25 000-name gazetteer, and a multilingual name model that runs in this tab) — becomes a realistic surrogate. The cloaked copy of the document text is what goes to the CloakAPI gateway; the reply is mapped back locally. The detected raw values — and the map that restores them — never leave the tab. If the name model cannot load, the conversion is refused and nothing is sent.

The gateway is fail-closed

The relay is the published SDK's fail-closed wrapper: it tokenises the whole request before sending, obtains a pretokenisation MAC, and blind-relays the surrogate body. If the engine can't load, or a secrets-class value (card / IBAN / national ID) is present, it refuses to send — it never falls back to plaintext.

A receipt on every job

Each conversion produces an egress receipt: what format changed, how many sensitive values were in the chamber, and exactly how many bytes — if any — were relayed. On-device jobs read 0 bytes, always.

The boundary is enforced by the browser

Every page ships a strict Content-Security-Policy. The only off-origin destinations the browser will even permit a connection to are the CloakAPI gateway and your account — nothing else can be reached, so a bug or a bad dependency can't quietly phone home:

connect-src 'self' https://api.cloakapi.io https://app.cloakapi.io

This is delivered as a real policy, not a promise. Deterministic conversions make no connections at all; the two allowed hosts are used only for AI-assisted relays (a cloaked copy) and billing.

What we can and can't claim

• We can say: deterministic conversions egress 0 bytes; on an AI-assisted job every value the engine detects is replaced by a surrogate before the copy is relayed, the re-identification map never leaves the tab, and a receipt records what happened.
• We won't say: that detection is complete. Structured identifiers — emails, phone numbers, dates of birth, cards, IBANs, passports, national/health/company IDs, IP addresses and postcodes — are deterministic and high-coverage. Person names are matched against an on-device dictionary, a ~25 000-name gazetteer, and a multilingual name model (DistilBERT NER) that runs in this tab — uncommon and non-Latin-script names are in scope. Detection is still not omniscient: an identifier none of the layers recognise can slip through. Organisations are recognised by a legal suffix (Ltd, GmbH, AS, Inc…) plus the on-device model, so a single-word company name can still be missed. Street addresses are matched in US number-first order, so a European “Storgata 14” style address is not detected as an address at all. On an AI-assisted conversion, anything not detected is relayed as written — read the receipt, and use a deterministic conversion (0-egress) if that matters for your document.

What about scanned images and OCR?

On-device OCR isn't available yet, so an image-only (scanned) PDF is detected and reported honestly rather than uploaded to a cloud OCR service — nothing is read or sent. Text-based PDFs, Word docs and the data formats all convert on-device today.