Enterprise Security & Trust Center
How OmitPII enforces zero-cloud data isolation, hardware-bound cryptographic security, and regulatory immunity for legal, fiduciary, and financial institutions.
Local Data Perimeter & Execution Boundary
Unlike cloud-hosted AI proxies or SaaS gateways that require organizations to route prompt streams and client files through multi-tenant intermediate cloud servers, OmitPII executes strictly within the customer's local workstation perimeter.
RAM-Only Processing: All detection, token replacement, and context restoration take place dynamically in active system RAM. Unredacted text is never written to disk or sent to an OmitPII server.
Direct Endpoint Routing: Sanitized prompt payloads travel directly over encrypted HTTPS/TLS from the client device to the enterprise-approved AI provider (Anthropic, OpenAI, Google). OmitPII acts as a local proxy on `127.0.0.1` and operates no external relay.
Network Containment: Even if OmitPII servers were completely offline, client workstation redaction operates with 100% autonomy.
Subprocessor Registry & DPA Exemption
Under UK GDPR (Article 28), EU GDPR (Article 28), and the Jersey DPL 2018, engaging a cloud software vendor that processes client personal data requires an extensive Data Processing Agreement (DPA), transfer impact assessments, and continuous audit of downstream subprocessors.
Entity Independence: OmitPII Ltd is a standalone private enterprise incorporated in Jersey, Channel Islands (Company No. 167349) and independently owned by its founder. OmitPII Ltd operates zero shared code repositories, zero shared cloud infrastructure, and zero corporate affiliations with any external software vendors or developers.
| Processing Scope | Subprocessors | Data Location | Regulatory Impact |
|---|---|---|---|
| Client Prompt Text & Matter Files | NONE (0) | Local Workstation RAM | No Art. 28 Processor Relationship triggered for prompt content |
| Commercial Pilot Licensing | Netlify, Inc. (Form submission) | United States (SCCs active) | Corporate business contact data only |
| Enterprise Support & Billing | Microsoft 365 | UK / EU Tenant | Standard administrative correspondence |
Cryptographic Key Management & Windows DPAPI
OmitPII eliminates third-party key escrow. All cryptographic keys, local audit databases, and configuration settings are protected using the native Windows Data Protection API (DPAPI):
- Hardware-Bound Derivation: Keys are cryptographically bound to the authenticated Windows domain user profile and local machine security identifier.
- Zero Master Cloud Keys: OmitPII Ltd holds no master keys, private tokens, or recovery certificates. Even under legal compulsion or subpoena, OmitPII is technically incapable of decrypting a firm's local audit storage.
- Zero Key Synchronization: Cryptographic material never travels across public network interfaces.
Foreign Subpoena & US CLOUD Act Immunity
The US CLOUD Act (18 U.S.C. ยง 2713) allows United States federal authorities to compel US cloud providers to disclose customer records regardless of whether data is stored within the EU, UK, or Channel Islands. This conflicts directly with GDPR Article 48 and Jersey DPL 2018 (Part 4).
OmitPII resolves this conflict by ensuring that no personal data or identifying records exist in the payload dispatched to US-headquartered cloud providers. Under the legal doctrine of technical inability, no overseas court order can compel disclosure of data that was permanently redacted before leaving the local machine.
Third-Party Verification & Penetration Testing
Enterprise trust requires verifiable engineering. OmitPII adheres to strict development lifecycle standards:
Scheduled independent third-party penetration testing program covering Windows process memory isolation and network boundary containment.
Comprehensive Data Protection Impact Assessment summary ready for CISO and DPO audit review.
Download CISO DPIA Summary (PDF) →Security Point of Contact & Responsible Disclosure
OmitPII maintains a direct channel for institutional security enquiries, vendor questionnaires, and responsible vulnerability disclosure:
Security Inquiries: hello@omitpii.com