Air-Gapped Client Runtime verified SOC-2 Type II Zero-Retain terminal SHA-256: 8c3e80f9...3ab1

Spec ID: SEC-PROT-2025-V2 • Formal Protocol Review

Security Architecture, Threat Model & Zero-Egress Protocol

Browser-observable checks for ToolAcre’s client-side computational sandbox. The controls below collect Resource Timing entries and same-origin source hashes in this tab, while documenting the limits of browser evidence.

check_circle Browser evidence • external signing required

monitor_heart

Live Network Isolation Telemetry

Bounded Resource Timing snapshot & Performance Observer probe

PROBE READY

Outbound POSTs N/A format_image_left Awaiting measured interval

WebSockets Open N/A power_off Not measured by Resource Timing

Tracker Beacons N/A do_not_disturb_on Awaiting measured interval

BROWSER RESOURCE TIMING EVIDENCE SOURCE: PERFORMANCE API

[READY] Resource Timing baseline not captured yet t=0.00ms

[SCOPE] No fetch or XMLHttpRequest monkey-patching is performed t=0.45ms

[SCOPE] CSP must be inspected separately t=1.12ms

[LIMIT] Run the probe to collect browser-visible resource entries t=2.00ms

No evidence probe has run in this tab yet.

memory

Ephemeral Heap Sanitation

Detached ArrayBuffer zeroization mechanics

Every payload processed within ToolAcre is isolated in an allocated TypedArray memory slice. Upon completion or component unmount, explicit memory zeroes are overwritten before releasing handles to V8/SpiderMonkey garbage collection.

Crypto Buffer Zero-Fill Routine 100% PURGED

Allocation Lifetime: < 240ms

Buffer Wipe: crypto.getRandomValues()

lock_reset Tab closure unconditionally triggers unreferenced RAM reclamation.

policy

Deterministic CSP Directives

Cryptographic enforcement configured at HTTP header level

connect-src 'none' HARD BLOCKED

Prohibits any outbound programmatic HTTP, HTTPS, WebSocket, WebRTC, or EventSource connection initiated by browser JavaScript.

script-src 'self' 'wasm-unsafe-eval' WASM SANDBOXED

Only first-party static assets and pre-compiled WebAssembly blobs are executed. Disallows inline dynamic string injection (`eval`).

object-src 'none' SECURED

Completely prevents legacy plugin vectors like Flash, Java Applets, or embedded ActiveX controls from instantiating.

frame-ancestors 'none' CLICKJACKING SHIELD

Eliminates clickjacking vectors by preventing any third-party website from rendering ToolAcre inside an `<iframe>` container.

schema

Client Sandbox Pipeline

Visual execution model across browser boundaries

Data never leaves the browser process boundary. Because all transcoding, parsing, formatting, and hashing occurs in client WebAssembly or Canvas contexts, zero transport encryption vulnerabilities (like TLS MITM) can expose raw payloads.

✓ Cryptographically Non-Exfiltrative Audit Ref: 2024.11-ZK

STRIDE Analysis Framework

Threat Model & Risk Mitigation Matrix

Direct comparison between traditional cloud SaaS utility architectures and ToolAcre's air-gapped paradigm.

Updated: Q1 2025 Audit

Attack Vector / Vulnerability	Traditional Cloud SaaS Risk	ToolAcre Zero-Egress Mitigation	Residual Risk
router Intermediary Server Eavesdropping	TLS downgrade attacks, compromised load balancers, or man-in-the-middle proxy egress logging.	100% in-browser WASM compilation. Zero network packets are dispatched over any interface.	NON-EXISTENT
database Database Data Breach & Leaked Backups	SQL injection, misconfigured S3 buckets, compromised cloud snapshots, unencrypted backups.	Zero server-side persistence. No relational or document databases exist in the compute path.	NON-EXISTENT
badge Employee / Insider Threat	Rogue administrator access to production servers, memory scrapers, SSH key theft, or support logs.	Staff have zero physical or logical avenue to reach ephemeral memory running in user browser processes.	NON-EXISTENT
cookie Third-Party Analytics & Telemetry SDKs	Session replay scripts (Hotjar, FullStory) inadvertently capturing sensitive text and clipboard data.	ToolAcre ships 0 analytics libraries, 0 tracking beacons, and strict CSP disallowing external tags.	ZEROED
devices Host OS Malware / Browser Compromise	Device-level keyloggers or malicious extensions read active DOM elements directly on client machines.	Scoped to user device hygiene. Recommended: Run in private window with extensions disabled.	LOCAL CLIENT

Audit Guarantee 01

Cryptographic Transparency

The downloadable browser evidence hashes the same-origin document, manifest, scripts, and styles actually returned to this tab. Reproducibility and authenticity require an external rebuild and detached-signature verification.

SHA-256 values generated on demand

Audit Guarantee 02

Air-Gap Offline Capability

Once loaded, disconnect your Wi-Fi or unplug ethernet entirely. Every codec, parser, and converter continues operating seamlessly in an air-gapped physical state with no degradation.

wifi_off Offline capability requires a separate disconnect test

Audit Guarantee 03

Zero Clipboard Snooping

We never query the navigator.clipboard API asynchronously. Clipboard ingestion triggers strictly and solely from deliberate user input paste keystrokes or explicit drop events.

content_paste_off Passive reading permanently disabled

Explore Architecture & Verification Resources

Privacy Statement arrow_forward

Legal commitment guaranteeing that customer data never enters ToolAcre infrastructure or sub-processors.

Updated January 2025

Air-Gap Protocol Verification arrow_forward

Step-by-step tutorial on inspecting network devtools to verify zero outbound socket or fetch transmission.

Technical Walkthrough

Apache 2.0 Manifest arrow_forward

Full open-source engine licensure details, third-party audits, and source provenance repository mirrors.

FOSS License