Air-Gapped Operation: Verifiable Offline Execution
Military-Grade Security: Cut the Cord, Keep Scrubbing
AI Summary / Key Takeaways
"Run 100% air-gapped PII scrubbing offline in local browser memory. Satisfies US compliance standards: HIPAA Safe Harbor, SOC 2 Type II, and CPRA."
Enterprise-Grade AI Privacy
Add custom redaction rules and priority support with PRO.
Interactive PII Detection & Sanitization Sandbox
Test real-time client-side RAM tokenization. Choose a specialized preset or paste your own raw prompt to test instant reversible redaction.
Sanitized locally in volatile RAM. Pre-prompt compliance maintained under Air-Gapped Operation standards (GDPR, HIPAA, SOC 2).
The Challenge with AI Data Workflows
Every SaaS provider claims they 'don't store your data', but verifying those claims requires expensive third-party audits and SOC 2 deep dives. If a security tool requires an active internet connection to sanitize data, you are inherently forced to trust their network security.
How It Works
Load the Tool
Open the site. The static code downloads to your browser RAM, meaning you don't need a persistent connection.
Go Offline
Disconnect your Wi-Fi (Airplane Mode) to verify that all scanning, encryption, and document processing run completely off-grid.
CISO DevTools Audit
Audit the code yourself. Type 'window.runCisoSecurityAudit()' in your browser developer console (F12) to run a security and network silence verification.
Supported Formats & Limitations
Supported Formats
System Limitations
- Requires initial 350KB payload download to cache the application logic
- Browser must not have JavaScript strictly disabled
- Total dataset size limited by the available RAM on the client device (typically up to 2GB per tab)
The Zero-Trust Data Sanitization (ZTDS) Architecture
Most privacy tools ask you to trust their privacy policy. PrivacyScrubber is built on a different premise: no trust should be required. The Zero-Trust Data Sanitization (ZTDS) architecture means every processing claim is independently verifiable by the user — with browser DevTools, airplane mode, or source code inspection.
Technical Architecture: How Local Processing Works
The tool consists of three files: index.html (UI), app.js (core logic), and styles.css. When you load the page, your browser downloads these files once. After that:
- Text scrubbing runs in a Web Worker — a background browser thread isolated from the UI. Your text never leaves this worker.
- Entity detection uses the deterministic ZTDS™ (Zero-Trust Data Sanitization) engine and WebAssembly in-memory tokenization — running in <1ms entirely client-side with zero network hops.
- Token encryption uses AES-GCM-256 via the
window.crypto.subtleWeb Crypto API — a browser-native cryptographic primitive with no external dependency. - Strict RAM-Only Session Isolation: The token dictionary (token→original mapping) is held exclusively in volatile RAM. It is scoped by a unique tab ID, preventing cross-tab leakage, and is never written to disk,
localStorage, or transmitted. Refreshing the tab instantly crypto-shreds the mapping.
Airplane Mode Verification: Step-by-Step
This is the fastest way to verify the zero-server claim independently:
- Open privacyscrubber.com. Wait for the page to fully load (under 1.5 seconds).
- Disconnect your network: turn off Wi-Fi, or enable Airplane Mode on your device.
- Paste any text containing names, emails, or phone numbers into the input.
- Click Protect PII. The scan completes — tokens appear in the output.
- The tool works identically offline. This proves the processing is local. No server was involved.
Network Inspector Verification
For a forensic-level proof:
- Open Chrome DevTools (F12) → Network tab.
- Check Preserve log. Filter by Fetch/XHR.
- Run a full document scrub.
- Inspect every request in the log. You will find zero requests containing your input text.
This is the verification method documented in our SOC 2 compliance guide.
Local Processing: Secure Workspace vs Chrome Extension
Secure Workspace
Processing runs in a Web Worker spawned from app.js. The worker receives a plain text payload via postMessage() — a structured clone transfer that never touches the network. Results are returned to the main thread via another postMessage() and rendered in the DOM.
Chrome Extension
The extension uses the ZTDS™ browser engine as a content script. It runs inside the browser's renderer process for the active tab. Communication between the content script and the popup uses chrome.runtime.sendMessage() — a local IPC mechanism. Zero network requests are made.
- Supported platforms: ChatGPT, Claude, Gemini, Copilot, Grok, DeepSeek, Perplexity, Qwen, Kimi, Zendesk, Notion, Slack (browser).
- Keyboard shortcut: Alt+Shift+P opens popup; Alt+Shift+X scrubs selected text silently.
- Session tokens stored in
chrome.storage.session— purged when the browser closes.
For compliance teams evaluating GDPR Article 25 (privacy by design), the GDPR & CCPA AI compliance guide details how client-side processing satisfies data minimization requirements by design.
Enterprise security teams conducting formal DLP gap assessments can review the SOC 2 AI privacy guide for a technical breakdown of how ZTDS satisfies CC6.7 (data disposal) and CC6.1 (logical access) controls.
Client-Side ZTDS™ Execution & Conformance Verification
All PII detection and deterministic tokenization execute 100% inside local client memory — eliminating cloud proxies, external subprocessors, and network data egress.
Frequently Asked Questions
Technical Details & Privacy Architecture
How can a website work without a server?
Does 'local processing' mean my data is never saved?
Can I use PRO features offline too?
What does 'Airplane Mode Verified' mean exactly?
How does the Chrome extension handle local processing?
Can I verify the zero-server claim without taking your word for it?
Protect Your Team's AI Prompts in Under 30 Seconds
No server uploads. No account required. 100% offline in your browser's local RAM.
