Security and trust

1. 1.1

   No deliberate write to disk

   No code path in the gateway writes raw input, masked output or the mapping table to disk, a log or a database. The container runs a read-only root filesystem with an in-memory /tmp. Measured: 200 PII-laden requests against the hardened container, all reconstituted, with a zero write-bytes delta on the process; the same check runs in CI on every change.

2. 1.2

   Deletion at the end of the request

   The mapping table is deleted from memory when the stream closes, with a safety-net time-to-live that renews on activity and an absolute cap for long reasoning models.

3. 1.3

   Buffers under our control are overwritten

   Every raw buffer the application holds is overwritten with zeros immediately after the attestation is signed.

4. 1.4

   A cryptographic receipt on every response

   The X-zer0pii-Attestation header is an Ed25519 signature over the hashes of the raw and the masked request, verifiable independently against the published JWKS. It attests to the hashing and to the overwrite of the buffers the application controls.

• Transient copies made by the Python runtime (the ASGI server, the JSON decoder, the regex engine) are released to the garbage collector but are not physically zeroed at once.
• Operating-system mitigations (memory locking, swap disabled, core dumps disabled, read-only filesystem) reduce this exposure but do not remove it. Exploiting it requires reading the live process memory, which means an attacker who already runs code on the host.
• Closing the gap fully is planned for a future data plane (a Rust core with deterministic zeroization, or a hardware enclave with silicon-level attestation). Until then, any "RAM scrub" wording means the buffers described above and nothing more.

The scope document overrides any marketing wording, including this page.

Source: docs/ZDR-SCOPE.md

A gateway that speaks the OpenAI, Anthropic and Gemini request formats sits between your tools and the provider. A deterministic tier catches identifiers with a fixed shape; a semantic tier detects names, organisations and places. Placeholder tags are derived from a keyed hash scoped to the conversation, so a provider's prompt cache keeps working and tags cannot be reversed to values. The browser extension runs the deterministic tier on-device before a prompt leaves the page.

Code is protected from masking by design: variable names, packages and syntax are left alone, and only hardcoded credentials inside code are redacted. That guard prevents false positives; it is not a barrier against a deliberate insider splitting a value across variables.

Source: docs/ZDR-SCOPE.md, docs/dev-tools/README.md

zer0pii is actively pursuing a SOC 2 Type II report with Security and Confidentiality in scope. Scope is decided and the readiness work is under way. No report exists yet, no date is promised here, and zer0pii does not describe itself as SOC 2 compliant before a licensed firm issues one.

Source: docs/compliance/soc2-readiness-plan.md

A DPA template written so that every technical statement in it matches the code and the scope document is available for counsel review. Ask for it from the legal page; it is offered after legal review, not before.

Source: docs/legal/dpa-template.md

Only the LLM providers receive text at all, and what they receive is masked. No subprocessor receives raw text.

Source: docs/compliance/subprocessor-list.md

The quarterly report format is published before the first edition: government and legal requests, disclosed incidents, subprocessor changes, uptime as published by the status page, and the zero-data-retention attestation summary. By decision it carries no error rates and no per-customer data.

Read the template (Repository path): docs/transparency-report-template.md

Known limits are documented rather than hidden: a value that looks like an ID but fails its checksum is left alone by design; a value that passes two countries' checksums is labelled by the first rule; prose that describes a number format can be masked as if it were a value; some national-ID values fall through to the phone label.

Weekly report location in the repository: docs/accuracy/

Source: docs/ENTITY-CATALOG.md, docs/known-limitations/masking-mislabels.md, docs/accuracy/

Found a vulnerability? Write to the security mailbox. Say what you found and how to reproduce it; do not include real personal data in the report. We acknowledge every report and keep you informed until it is closed.