ZTDS.ai
OPEN SPECIFICATION v1.0 · ZERO-SERVER ARCHITECTURE

The In-Memory Security Standard for Generative AI

Zero-Trust Data Sanitization (ZTDS) executes PII de-identification strictly inside volatile client RAM before prompts or tool calls reach LLMs. Sub-2ms execution. Exactly 0 bytes of sensitive data transmitted. Fully DPA-exempt.

<2 ms
Local RAM Latency
0 Bytes
Network Egress
DPA Exempt
GDPR Art. 28 / HIPAA
Argon2id
+ XChaCha20 Transport
zt-inspector-preview · RAM-only V8 Runtime
Airplane Mode Verified
Auto-detected PII
Patient John Doe (SSN: 987-65-4321, email: j.doe@hospital.org) diagnosed with severe hypertension. Doctor Sarah Jenkins MD prescribed Lisinopril 20mg daily. Routing inquiry to OpenAI GPT-4.
Execution: 0.8ms
Patient [NAME_1] (SSN: [SSN_1], email: [EMAIL_1]) diagnosed with severe hypertension. Doctor [NAME_2] prescribed Lisinopril 20mg daily. Routing inquiry to OpenAI GPT-4.
RAM Session Map: 4 Isolated Tokens Outgoing Network Calls: 0
Open Full DAG Visualizer →

The Architectural Difference

Why legacy Cloud DLP proxies fail modern enterprise AI security requirements.

Legacy Cloud DLP Proxy

Blind Trust
  • × Data Egress: Cleartext transmitted over WAN to third-party vendor servers.
  • × Latency Overhead: 150ms – 300ms network roundtrips destroy interactive agent UX.
  • × Regulatory Burden: Vendor becomes a Data Processor; requires custom DPA, BAA, and security questionnaires.
  • × Vector Poisoning: PII leaks into RAG embeddings permanently violate GDPR Art. 17 (Right to be Forgotten).

ZTDS In-Memory Architecture

Zero-Trust
  • 0-Byte Egress: Sanitization executes strictly in volatile client RAM before socket write.
  • Sub-Millisecond Speed: <2ms in-memory regex evaluation (OSF Benchmark).
  • DPA Exemption: Zero server processing means zero Data Processor status under GDPR Art. 28.
  • RAG Immunization: Chunks tokenized before embedding guarantee mathematical compliance with right-to-erasure.
BUILT FOR MODERN ROLES · ZERO COMPROMISE

How ZTDS Solves Your Exact Operational Reality

Whether you are signing off on enterprise vendor risk, engineering high-throughput AI agents, or trying to close enterprise SaaS deals faster, ZTDS delivers immediate mathematical certainty.

CISO & Legal Counsel 0-Day Approval

Eliminate 6-Week Security Reviews & Vendor DPAs

Stop blocking employee AI productivity or signing risky vendor Data Processing Agreements. Zero server egress means zero vendor processing liability.

  • GDPR Art. 28 DPA Exemption: Zero server storage or intermediary processing mathematically relieves vendor processor status.
  • Airplane Mode Audit: Disconnect Wi-Fi and verify full de-identification in 30 seconds with 0 outgoing packets.
  • RAG Immunization: Guarantees customer PII never poisons high-dimensional vector embeddings or LLM training pools.
AI Engineers & DevSecOps <2ms Latency

Sub-2ms Sanitization Without Breaking Token Stream Context

Cloud DLP proxies inject 250ms of network latency and break streaming tokens. ZTDS runs purely in-process inside V8/WASM memory with zero latency penalty.

  • Sub-Millisecond Speed: <2ms in-memory regex execution preserves high-frequency agent tool calling.
  • Lossless Reverse Unmasking: LLM response tokens [NAME_1] are restored to originals in local RAM.
  • Drop-In SDK & MCP Server: One-line integration for Node.js, Express, LangChain, Cursor, and Claude Desktop.
AI SaaS Founders & Leaders 10x Deal Velocity

Unlock Enterprise Procurement Deals on Day 1

Don't lose enterprise contracts to 4-month security questionnaires. Display the verified ZTDS Trust Badge and give CISOs mathematical proof of privacy.

  • Dynamic Trust Badge: Embed the verifiable SVG badge on your pricing and security landing pages.
  • Inclusion in llms.txt Directory: Get indexed by Perplexity, Gemini, and AI search engines as a verified privacy-safe tool.
  • Zero Infrastructure Cost: No cloud proxy bills, no latency SLAs to manage, and zero data breach exposure.

The 4 Invariants of ZTDS

Every compliant implementation must cryptographically and empirically adhere to these rules.

INVARIANT 01

Volatile Memory Boundary

The session token map resides strictly in volatile host RAM. Under no circumstances may mapping pairs be persisted to localStorage, cookies, IndexedDB, or swap space.

INVARIANT 02

Sub-2ms Latency Ceiling

Total parsing, entity extraction, and token substitution must complete within 2 milliseconds per 15,000-character block, ensuring zero perceptual friction for developers and users.

INVARIANT 03

Zero Network Transmission

The sanitization engine must pass the Airplane Mode Standard: complete de-identification and reverse re-identification functional with all network adapters disabled.

INVARIANT 04

Cryptographic Transport Handoff

When teams require collaborative unmasking, token maps must be encrypted using Argon2id key derivation and XChaCha20-Poly1305 symmetric authenticated encryption.

Join the ZTDS Syndicate

Verify your AI agent or SaaS platform against the ZTDS specification. Earn the dynamic ZTDS Verified Trust Badge, accumulate organic backlinks, and get included in the global llms.txt knowledge base.