1 · Parsing + cloaking are 100% on-device
When you drop a file or paste rows, the CSV/TSV/xlsx is parsed in the tab — no upload. Each cell is run through the published CloakAPI browser engine (a WebAssembly tokeniser plus an on-device name dictionary). Sensitive cells — names, emails, dates of birth, phone numbers, IP addresses, national IDs, cards — are replaced with realistic, locale-matched surrogates. Secrets-class values (cards, national IDs) become opaque, locked markers that can never be revealed. During this step the app makes zero network connections. Watch the live egress monitor: the third-party counter stays at 0.
2 · Only the schema and surrogates are relayed
When you ask a question, we build a request containing your column names and a small sample of surrogate rows — never a real value. That request is relayed to the CloakAPI gateway through the published SDK's fail-closed wrapper, which re-tokenises the whole body, obtains a pretokenisation proof, and only then forwards it. The model reads the schema and writes analysis code. It never sees, and never needs, your real data.
3 · The analysis runs on your device
The model's Python is executed in a sandboxed Web Worker on your machine, using a pinned, same-origin Pyodide runtime. The worker is served with a connect-src 'self' Content-Security-Policy and installs a no-network guard as its first statement, so the code that touches your real rows cannot reach the network at all — belt and braces. pandas, numpy and matplotlib run over your real numbers; the answer and any charts are written to an in-memory folder and rendered locally.
4 · A receipt, not a promise
After each analysis, the receipt shows how many cells were cloaked, by category, and how many raw-PII bytes left the tab: 0. The only bytes that egress are surrogate-bearing schema text, and that number is shown too. The re-identification map that restores your originals never leaves the browser.
What we can and can't claim
- We can say: your real cell values never reach the gateway or the model; the analysis code runs locally with no network; a signed receipt records what happened.
- We won't say: that detection is perfect. Structured PII (emails, cards, IDs) is deterministic and high-coverage; person-name detection is a strong best-effort dictionary and can miss uncommon or non-Latin names. Reveal originals and scan the grid before you rely on a column being fully cloaked.
The platform's full legal terms — Terms of Service, Privacy Policy, Data Processing Addendum and data-subject requests — live at cloakapi.io/legal ↗.