Home/Docs/Security & Compliance

Security architecture & threat model

Detailed technical specification for security architects, CISOs, and platform engineers evaluating the cryptographic boundaries and threat mitigations implemented across RedactNode.

Updated Sep 17, 2026

||View API spec

RedactNode adheres to a strict zero-knowledge proxy architecture. Identifiers are tokenized at the enterprise boundary, transient mapping keys are isolated in volatile memory with enforced TTLs, and upstream AI vendors never receive customer personal data in cleartext.

Zero Plaintext Data LakeRedactNode does not operate a centralized storage lake of customer prompts or PII mappings. The architecture is designed so that a total breach of the gateway database yields zero reconstructable personal identities.

1. Cryptographic Primitives

Standardized industry algorithms applied across data in-transit, session memory, and tamper-evident audit trails:

PRIMITIVE	PURPOSE	SECURITY SPECIFICATION
AES-256-GCM Envelope Encryption	Session Token Vault Mappings	Every token-to-PII mapping pair is encrypted using authenticated 256-bit Galois/Counter Mode before writing to in-memory Redis storage.
HMAC-SHA256 Cryptographic Signatures	Audit Event Immutability	Audit metadata digests are sealed using HMAC-SHA256 signatures, ensuring non-repudiation proof during regulatory investigations.
Volatile RAM Session Expiry	Zero-Persistence Key Shredding	Session keys expire automatically via Redis TTL (default 15 minutes). No cleartext keys or mapping pairs are ever flushed to persistent disk.
Chromium Manifest V3 Isolated World	Client-Side DOM Protection	Tanda Guard extension content scripts execute in isolated worlds, completely invisible and inaccessible to malicious webpage JavaScript.

2. In-Memory Vault Lifecycle

The token vault stores the reversible lookup table between synthetic surrogate tokens and cleartext PII. It enforces the following security boundaries:

Volatile RAM StorageMappings are stored purely in Redis volatile memory. Redis AOF (Append-Only File) and RDB snapshotting can be disabled via configuration to guarantee zero persistence on physical SSDs.

Automatic Session Expiry (TTL)Every mapping key is stamped with a strict TTL (default: 900 seconds / 15 minutes). Once the completion stream finishes or the TTL expires, the key is permanently purged by the Redis eviction loop.

Authenticated EncryptionPayloads are wrapped in AES-256-GCM authenticated ciphertexts before Redis insertion, requiring the master VAULT_ENCRYPTION_KEY to decrypt.

3. Chrome MV3 Isolated Worlds

When using Tanda Guard in employee browsers, content scripts run within Chromium's Manifest V3 Isolated World execution environment:

// Chrome MV3 Execution Boundary:

[Host Webpage (ChatGPT / Claude / Copilot)]

└── Page JavaScript context (No access to extension memory)

[Tanda Guard Isolated World]

├── Intercepts paste and submit events on DOM input element

├── Tokenizes Malaysian PII inside local WebAssembly runtime

└── Rewrites DOM value with non-sensitive surrogate tokens

4. Threat Matrix & Mitigations

Comprehensive threat vectors evaluated during enterprise penetration testing:

Prompt Injection & Jailbreaks

Threat Vector: Adversarial prompts engineered to bypass safety guidelines or leak private context.

RedactNode Mitigation: Deterministic regex and Malaysian state code validation run in local web workers prior to LLM dispatch. Malicious PII harvesting patterns are neutralized before reaching the model.

Upstream Model Training Ingestion

Threat Vector: Proprietary enterprise prompts absorbed into foundation model training weights.

RedactNode Mitigation: The external AI receives only synthetic surrogate tokens (e.g. [MYKAD_TOKEN_850315]). The real customer identity never enters the provider training corpus.

Internal Audit Log Exfiltration

Threat Vector: Attackers or rogue administrators accessing central IT logs to read employee prompts.

RedactNode Mitigation: Zero-honeypot architecture: RedactNode logs timestamps, rule identifiers, and deterministic SHA-256 digests. Raw prompt text is strictly excluded from diagnostic logging.

Malicious Webpage Script Snooping

Threat Vector: Third-party analytics or compromised web scripts intercepting extension memory.

RedactNode Mitigation: Chrome MV3 Isolated World boundary guarantees zero shared JavaScript scope between the host webpage and the Tanda Guard inspection worker.

Next steps

Malaysian PDPA Compliance

Statutory legal analysis of Act 858 & cross-border AI rules.

Read PDPA Guide →

Deployment Blueprint

Deploy the gateway container in your own private cloud.

Deploy Container →

← Quickstart REST API Reference →