01 · Zero-knowledge encryption
We literally cannot read your evidence.
Argon2id key derivation happens in your browser. Every evidence file is encrypted with a key derived from your master passphrase before it leaves your device. CertiFlow PLUS servers receive ciphertext. We store ciphertext. We back up ciphertext.
If CertiFlow PLUS is subpoenaed, breached, or compromised — the answer an attacker receives is mathematical static. The keys never touch our infrastructure.
Detailed ZKE algorithm spec and threat-model is published in our Data Processing Agreement Annex III. We invite independent cryptographic review on request.
01a · How AI works under Zero-Knowledge Encryption
AI never touches the encrypted vault.
A common security-team question: “If evidence is client-side encrypted, how does the AI read it to draft anything?” It does not. The vault stays ciphertext throughout every AI interaction.
What the AI actually sees is data you deliberately submit at the moment of the request — a control description you paste into the Analyzer, a question you type into the Advisor, a URL you enter into the Scan, a snippet of a document you attach to Document Review. Never the vault. Never keys. Never other tenants’ data.
Under the hood: AI requests go from your browser to our server, out to the model provider, and back. The prompt content is discarded after the response is returned; only the resulting AI text (and a hash-chained audit-log entry of the interaction) is written back to your tenant. If you never paste plaintext into an AI surface, no plaintext leaves your device.
This is the honest trade-off of every “AI + encrypted evidence” platform: the encryption model protects the durable store; the AI runs on the transient text you choose to share. Full data-flow diagram published in our DPA Annex III.
02 · Tamper-evident audit chain
Every state change is hash-chained.
Each row in the audit log carries a SHA-256 hash of (its canonical representation) + (the previous row’s hash). The chain is verifiable in a single server-side call that re-derives every row and confirms nothing has been altered.
Roadmap: hourly Merkle-anchor to an external immutable object store (S3 Object Lock or equivalent), delivering an insider-threat-resistant tamper-evidence guarantee. Not shipped in v1.
An auditor — or a regulator — can verify the chain independently. If a row has been added, removed, or altered, the hash chain breaks and the discrepancy surfaces at the next anchor window.
This is the foundation of audit-grade provenance. Every evidence upload, every status change, every page view by an external auditor is logged into the same chain. Nothing recorded can be quietly walked back.
03 · Eight layers of defence in depth
Each layer addresses one or more named threats. None stands alone.
| Layer | What runs | Closes |
|---|---|---|
| Edge | Vercel edge WAF + bot mitigation + 2,000 req / 5min rate limit | Indirect prompt injection at the boundary, automated abuse |
| Auth | Supabase Auth (customers) · IAM Identity Center + hardware MFA (operator) · OIDC federation (CI/CD) | Credential theft, unauthorised access |
| Transport | TLS 1.3, ALB drops invalid headers, HTTPS-only with HTTP→HTTPS redirect | Eavesdropping, downgrade attacks, request smuggling |
| Engine | 5-layer input hardening: Guardrails → OCR pipeline → input sanitiser → trust-boundary frame → strict JSON schema validator | Prompt injection, exfiltration, schema poisoning |
| Data | Pattern A discipline — customer document content NEVER persisted to durable storage. Only metadata. | Data-loss blast radius minimised by construction |
| Audit | SHA-256 hash chain over every state change with one-click server-side verification. External tamper-evidence anchor: roadmap. | Silent state change, evidence tampering |
| Identity | No long-lived cloud credentials. CI/CD via GitHub-OIDC to Vercel. Hardware MFA for break-glass. | Credential leak, lateral movement |
| Backup | Nightly Supabase point-in-time snapshots retained 30 days. Cold-immutable backup to isolated object storage: roadmap. | Catastrophic data loss, ransomware |
| Process | Multi-LLM cross-review (binding rule) · monthly external reviewer · CI/CD signed deploy-log watchdog (15-min detection) | Self-approved malicious change, sole-founder insider risk |
Reference frames: OWASP API Top 10 (2023), OWASP Top 10 for LLM Applications (2025), and CISA Cybersecurity Performance Goals (CPG 2.0, 2024). We deliberately do not publish "X% reduction" numeric claims — no independent benchmark of AI-attack reduction has been peer-reviewed at the time of writing.
04 · What an attacker can actually take
Honest scope — by scenario.
| Scenario | What an attacker obtains |
|---|---|
| Lawful court order, customer-specific | Ciphertext + plaintext metadata only |
| Production database breach | Ciphertext only at rest |
| Out-of-band backup vault breach | Ciphertext only at rest |
| Compromised CertiFlow PLUS insider with root | Metadata only; cannot decrypt evidence |
05 · Operational hygiene
Practices, not promises.
- No long-lived cloud credentials. CI/CD authenticates to Vercel via GitHub-OIDC, trust narrowed to the main branch of our repo. Operator access to the platform console requires hardware MFA.
- Signed deploy-log watchdog. Every CI/CD deploy is signed and recorded in an out-of-band log. A 15-minute watchdog alerts on any deploy that lacks a matching pull request.
- Multi-LLM cross-review. Every architectural decision and every engine prompt change is reviewed by a second large language model independent of the one that drafted it. Binding rule.
- Monthly external reviewer. During the sole-founder period an independent reviewer signs off on the audit log, the deploy log, and the access log monthly. Retires when CertiFlow PLUS hires a second engineer with a same-day code-review SLO.
- Encrypted backups. Supabase point-in-time recovery for the tenant Postgres, retained 30 days. An isolated, out-of-band immutable backup to object storage is on the roadmap.
05a · Recent security reviews
Cross-reviewed by a second LLM, on the record.
Every consequential change is reviewed by an independent large language model. The reviews below are public so you can audit our remediation work, not just our promise of it. Findings are categorised CRITICAL / HIGH / MEDIUM / LOW; CRITICALs block launch.
- 2026-06-18 · ZKE library cross-review (Gemini). Closed 1 CRITICAL (plaintext SHA-256 known-plaintext leak — switched to ciphertext-hash semantics), 3 HIGH, 1 MEDIUM. Verification: /crypto-test step 9.
- 2026-06-20 · Hash-chain audit log cross-review (Gemini). Closed 3 CRITICAL + 2 HIGH + 1 LOW findings in the hash-chain audit log implementation. The construct-and-verify paths now share a single canonical helper, indexed row sequencing has been added, and every write is serialised through a two-argument advisory lock. An external tamper-evidence anchor for insider-threat defence remains on the roadmap.
- 2026-06-20 · Policy Pack cross-review (Gemini). Closed 3 CRITICAL (PostgREST role bypass, approved_at re-approval invariant, client-controlled audit_action) + 2 HIGH + 3 MEDIUM via companion API hardening. Role-aware RLS is applied to the policies table via internal helper functions; strict status state-machine seeded as a queryable table; server-computed audit_action.
- 2026-06-20 · Regulatory corpus data-model cross-review (Gemini). 2 CRITICAL + 4 HIGH addressed in the corpus architecture. Most consequential: localized JSONB clause fields (so French and Arabic auditors don’t hit English research notes after the Tier-1 marketing localization landed), and proprietary interpretation abstracts for copyrighted clauses to prevent RAG-pipeline hallucination on ISO/AICPA standards.
Full Gemini review responses are committed to the repository under the review record and the matching closures land as SQL migrations and code commits you can read line-by-line. Pre-launch, no production data has touched the affected code paths.
06 · Sub-processors
Materially shorter list than incumbents.
Because evidence is held under zero-knowledge encryption, no sub-processor sees plaintext. The disclosure list is therefore materially shorter than incumbent GRC vendors. Full disclosure with jurisdictions, processing purposes, and Data Processing Agreement references in the sub-processor list.
07 · Compliance posture
What we ship vs what we are pursuing.
- · ZKE applied to all customer evidence
- · Hash-chained audit log + hourly Merkle anchor
- · OIDC federation + hardware MFA
- · Daily out-of-band encrypted backups
- · GDPR / UK-GDPR mappings active; FADP + POPIA crosswalked to GDPR (dedicated seeds Q3 2026)
- · SOC 2 Type I attestation (own posture)
- · ISO/IEC 27001:2022 certification (own posture)
- · Penetration test report (annual)
- · External DDoS mitigation (AWS Shield Advanced or equivalent) — gated by MRR threshold
Found a security issue? Or have a procurement question?
Report security issues to shaun@directcs.net. Procurement and Trust Center questions to shaun@directcs.net. We respond within one business day; security reports get acknowledged within four hours.
Companion pages: live status · CertiFlow PLUS’s own Trust Center · Data Processing Agreement.