The architecture is the privacy policy.

US Patent 12,665,758

Every inference verified. Every byte accounted for. No server to trust.

See the architecture Try the tool

Try it. Right now.

Paste text or drop a file (PDF, Word, Excel, PowerPoint, image). First load downloads the model (~250MB) from this site, no third-party CDN, cached after.

Requests to other hosts: countingModel: loadingThis device: measured at your first scan

×

Drop file here, PDF, Word, Excel, PowerPoint, image, or text file

Redacted document, then a compliance report: entity summary and audit chain

Paste into AI tools

Save clean text for AI tools

Placeholder ↔ original (sensitive)

AES-256-GCM T_max:

Keep specific text from redaction (optional, comma-separated):

Custom entity patterns (optional, Name:regex, comma-separated, max 10, 200 chars each):

Output mode: Redact with labels [NAME], [EMAIL] Tokenize with IDs [NAME_1], [EMAIL_1]

Use tokens if the AI needs to distinguish between entities (e.g., multiple clients in one document).

Annotated Text

Scan a document to see results

Audit Chain NOT VERIFIED

No events yet

What it does

Before

John Smith, CEO of Acme Corp, met with Dr. Sarah Chen at john@acme.com. SSN: 123-45-6789. Card: 4111 1111 1111 1111.

After

[NAME], CEO of [ORG], met with Dr. [NAME] at [EMAIL]. SSN: [SSN]. Card: [CREDIT_CARD].

Most popular use case

Want to use ChatGPT on your documents?
Clean them first.

Your employees are already using AI tools. The risk isn't the AI, it's sending unredacted patient records, financial statements, or legal transcripts to an external model.

ZeroEgress removes the sensitive information before anything leaves the device. What gets shared with the AI contains no names, no IDs, no protected data.

1

Drop the document into ZeroEgress

2

Download the de-identified version

3

Upload that to ChatGPT, Claude, or any AI

Identifiers are removed before anything is shared. Full AI productivity.

Try it now, free

Before

Sarah Chen reported harassment by Mark Davis on 03/15/2024.

Contact: sarah@company.com

SSN: 321-54-9876

⚠ Can't upload this to ChatGPT

After ZeroEgress

[NAME] reported harassment by [NAME] on [DATE].

Contact: [EMAIL]

SSN: [SSN]

✓ Safe to upload to any AI

Who is this for?

Anyone who needs to share documents without sharing the sensitive parts.

Healthcare

Share patient files with researchers. Remove names, doctors, hospitals. The Safe Harbor text identifiers removed in seconds, not hours; review before you rely on it.

Legal

Prepare documents for discovery or opposing counsel. Strip names and locations from transcripts, contracts, case files.

Human Resources

Anonymize employee complaints, performance reviews, or investigation reports before sharing with external consultants.

Finance

Remove client names, account numbers, and SSNs from financial documents before audit or regulatory submission.

Education

Anonymize student records for research or reporting, and review the result before it is shared.

Any regulated industry

If you can't send unredacted documents to the cloud, but you need AI-quality redaction, this is how.

What it detects

Person names Organizations Locations Email addresses Phone numbers Fax numbers Social Security Numbers Credit card numbers IBANs IP addresses URLs Dates ZIP codes Account numbers Medical record numbers (MRN) Patient and claim IDs Health plan beneficiary numbers Ages over 89 Driver's license numbers VINs National ID numbers

Why not just use ChatGPT?

Most alternatives send your data somewhere. ZeroEgress doesn't.

	ChatGPT / Claude	AWS Comprehend	Redactable	Presidio / CaseGuard	Adobe	ZeroEgress
Data stays on device	✗	✗	✗	✓ (needs server)	✗ (online) / ✓ (desktop)	✓
AI-powered detection	✓	✓	✓	✓	✗	✓
No installation needed	✓	✗	✓	✗	✓ (online)	✓
Cryptographic audit trail	✗	✗	Audit log (not cryptographic)	Partial	✗	✓ HMAC-SHA256 chain + ECDSA-signed export + signed compliance certificate
Verified AI model supply chain (signed manifest, per-segment hash check)	✗	✗	✗	✗	✗	✓
Memory clearing (NIST)	✗	✗	✗	✗	✗	✓
Verifiable (DevTools)	✗	✗	✗	✗	✗	✓

For a detailed comparison with specific redaction tools, see the full comparison

Under the hood

For the security team. Everything your CISO will ask about.

Zero network egress

The AI model (DistilBERT fine-tuned for NER, dslim/distilbert-NER, ~250MB) runs locally via WebAssembly, with zero outbound requests during processing, which you can verify in the DevTools Network tab. Nothing runs in this page that we have not signed: if a CDN or an extension ever injects a script, the Content-Security-Policy blocks it and the browser reports it in the console.
Verifiable DistilBERT
End-to-end encryption

AES-256-GCM via the SubtleCrypto API. The keys are non-extractable: they are held by the browser's cryptographic implementation and are never exposed to page JavaScript, which cannot read them.
SubtleCrypto
Session key isolation

Each session derives unique HMAC keys from a master key via HKDF-SHA256 with session-specific context, so sessions are cryptographically isolated and audit entries from a prior session cannot be verified under a new session's key. Sessions expire after one hour; a new session starts in place, and its origin commits to the previous session's head.
HKDF-SHA256 Session isolation
Memory clearing

After every operation, plaintext is overwritten with a 3-pass NIST SP 800-88 compliant sequence. XOR bit-difference verification confirms the wipe.
NIST SP 800-88 Compliant
Tamper-evident audit

An HMAC-SHA256 chain covers the whole session from first page load: verified model delivery, encrypt, decrypt, infer, wipe, and a record for every detection stage. One click exports the evidence, an ECDSA-signed JSON audit trail, CSV, and the redaction map, plus a signed compliance certificate built only from what the session actually observed; a third party verifies all of it offline with standard tools, the evidence bundle carries the temporal anchor described below, and the certificate includes that anchor as one of its checks.
HMAC-SHA256 + ECDSA-P256
Attested supply chain

The WASM engine and the model manifest each carry an ECDSA-signed attestation that the browser verifies against a pinned key before anything runs, every model shard is SHA-256-verified before use, any mismatch fails closed, and every verification is recorded as an audit event. The engine hash the attestation signs over is reproducible for a given toolchain (identical source built with the same rustc, wasm-pack and wasm-bindgen versions yields the same SHA-256, while a rebuild with a different wasm-pack or wasm-opt yields a different hash from identical source), and the attestation (wasm-attestation.json, field toolchain) names the toolchain that produced the deployed engine (currently rustc 1.93.0, wasm-pack 0.15.0, wasm-bindgen 0.2.128, wasm32-unknown-unknown, wasm-opt disabled), so a third party can rebuild it and compare.
Fail-closed attestation
Anchored in time

The origin of the chain binds an externally attested time value, read from the response that delivers the model, so obtaining it sends nothing, and a verifier who trusts whoever issued that value learns that the records cannot predate it. The head of the chain is committed as a digest only, each session's origin commits to the previous session's head, so a session removed from a set is detectable, the exported evidence bundle names the anchoring mode in force, and having that head digest timestamped externally, which adds the matching latest bound, is available to a deployment rather than automatic.
Patent pending
Bounded plaintext window

Decrypted text is processed in segments sized so that each stays inside the T_max window on the device in use; before anything is decrypted, the engine measures the device, and a window it cannot honour is refused and the refusal is recorded. If a segment still exceeds the window, the emergency wipe triggers and is recorded.
T_max enforced
Browser isolation

Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) headers prevent Spectre-class side-channel attacks. WASM runs in a sandboxed execution environment.
COOP/COEP
Side-channel mitigations

Sensitive comparisons use constant-time operations (bitwise, branch-free) to prevent timing side channels, and memory fences around wipe passes prevent compiler or CPU reordering. Saturating bounds checks on user-controlled indices mitigate Spectre-style speculative execution attacks, and sensitive key material is stored on 64-byte cache-line aligned buffers.
Constant-time Cache-aligned Spectre mitigation
PDF output construction

Redacted PDFs are built from scratch via new jsPDF(): the original file's bytes are never copied, only the extracted, NER-processed, redacted text is rendered into a fresh document, and no author metadata, XMP streams, revision history, or embedded scripts carry through. Coverage note: extraction reads the document's text layer, comments, and form fields, and standalone image files are run through OCR, but text inside images embedded within a document is not OCR'd in place and will pass through unredacted, so extract such images as separate files to redact them.

ZeroEgress scans the text extracted from the document. For Word files (.docx) that is the document body: headers, footers, footnotes, comments, and text deleted under tracked changes are not part of the extracted text, so they are not scanned or redacted. Accept or reject tracked changes, and review headers, footers, and comments separately when they may hold sensitive content.
Zero metadata carry-through Embedded-image caveat
Reversible tokenization

Alongside static redaction, entities can be replaced with reusable tokens, [NAME_1], [EMAIL_1], [PHONE_1]; the tokenized text can be pasted into an external AI tool, and the tool's response is then run through the local Reveal map, which restores the original entity values. The reveal map is never transmitted and is discarded when the session ends; you can export it yourself as the redaction map, which is marked sensitive.
Reveal map, client-side only
Profile auto-detection

Content patterns in the input, MRN numbers, IBANs, CVE identifiers, case numbers, APT indicators, select one of nine regulatory profiles (healthcare, financial, legal, legal_strict, cybersecurity, content_moderation, government, communication, default), and each profile sets a different T_max plaintext memory window. The detection runs entirely in the browser as deterministic regex matching against the extracted text, the selection can be overridden at any time via the T_max dropdown, and the selection and the content signals that drove it are themselves recorded in the audit chain.
Continuation 19/636,972 (allowed)
Permanent redaction, real text

Redacted documents are generated as new files, original text is never present in the output: no hidden layers, no recoverable data. Unlike pixel-burn approaches, output remains searchable and accessible, because it's real text, not a flattened image.
New file generation
Self-hosted and air-gapped

The same application and model, as a signed offline package with a generated server configuration, runs on your own server with no connection to the internet. Tested that way on 2026-09-26: the full test suite and a verified evidence export, on a network with no route out. Available on request: write to contact@zeroegress.ai.
Signed package Tested offline

A record from a real session, as exported

ANCHOR source=http_date digest=6adff84ceee57f4f0ccbcbb7fd0c430c anchor_age_ms=2177 prev_head=036d97d4b8543f0a
STAGE_MODEL stage=model in=fa7800fc26d9e1a68eeb181dcbf29cb5d3ad7d4bab536bd2deebdf071d3fcf67 out=2325bbae737a45f99116c76ca24c269bd414225fa8f6c71f37271c7eee023c64 entities=4 widened=0 dropped=0 dropped_terms=0 chars=132
"head":"d6ce0479d6472010082595fd42149283fbe7178edb43818a556cb799567c6e5f"

Three lines from one session on this build, exported on 2026-09-24 and copied without change: the ANCHOR event (event and detail) from the signed audit export, the STAGE_MODEL record from the redaction map, and the committed head from the evidence bundle.

Compliance

SOC 2 reports, ISO 27001 certification and HIPAA business-associate obligations all concern a vendor's server-side data handling. ZeroEgress has no server-side data handling: documents never leave your device. The compliance question doesn't apply to our architecture.

For your organization's compliance work: since no data leaves the device, ZeroEgress doesn't create new compliance obligations. No DPA needed. See our Privacy Policy for details.

ENCRYPT INPUT HASH DECRYPT NER (WASM) WIPE RE-ENCRYPT OUTPUT HASH

All seven steps, including Named Entity Recognition (NER) inference, execute inside the browser. The model never sees a server. The audit chain records every step with cryptographic integrity.

Looking for the simple version to share with your team? See the user-facing page