Security, in checkable claims

The engine, built and testable today

Four of the five claims below you can check in the live demo with your network inspector open, or in your browser console. The fifth, that the engine writes nothing to disk, you check by reading it, and we will hand it to your team to read.

• One deterministic engine, compiled from Rust to native code and WebAssembly. No randomness, no model weights, no sampling: no AI model is involved in detection at all. Same input and same session state, same output. The one thing that carries over is session memory. Once a name has been identified under a form label, the engine keeps masking it when it turns up on its own later in the same conversation, which is why page four of a document is covered as well as page one. It is deliberate, and the application that calls the engine can clear it.
• It has no network code. Not “it doesn’t phone home”: there is no code inside the engine capable of opening a connection. You do not have to take our word for it. Open the console on this page and run:

  WebAssembly.instantiateStreaming(fetch('/nonimo_core.wasm'), {})
    .then(m => console.log(WebAssembly.Module.imports(m.module)))

  It prints []. An empty import list. A WebAssembly module can only call the functions it is handed when it is instantiated, and this one is handed none, which is why the demo can instantiate it with an empty object: it cannot open a socket, read a file or read the clock, because those functions were never given to it.
• It writes nothing to disk. The engine has no file access, and that was checked line by line in our security review of July 2026. The map that restores masked values lives in memory and belongs to the application calling the engine; the engine offers no way to persist it. One caveat we would rather give you than have you find: any operating system can page an application’s memory out to swap or to a hibernation file, which is why we recommend full disk encryption, which you almost certainly already have. The compliance panel will store the counts and categories it receives, because that is what a monthly report is made of. It will run on your server and you will set the retention.
• Detection is layered by how much proof we have. Identifiers with a check digit (Medicare, TFN, ABN, IBAN, national IDs) are cleaned automatically, because arithmetic settles it. Anything found by position or wording, such as names, addresses and case references, is masked visibly, with a one-sentence reason, and one click puts it back. By default nothing is removed silently without arithmetic proof. Two things can change that, and both are yours to set: the terms you load yourself, which are handled the way you configure them, and the policy level your IT team picks, five of them, from observe to block.
• No name lists of ours. We ship no dictionary of first names or surnames. Names are found by their position: the form label, the signature, the courtesy title before a surname. Coverage therefore does not depend on how common a name is or where it comes from, which is the entire point of building it this way. The one list involved is yours. Your own client and matter names, loaded by you, matched on your own computer, never sent to us.

What leaves each computer

Today the engine is the only piece that exists, and it sends nothing because it has nothing to send with. The rest of this section is a commitment about software we are still writing, and you should hold us to it.

• In the free app: nothing, unless you switch on the coverage report. No account, no telemetry, and detection will never need to reach a server of ours, not even to update itself.
• The optional coverage report is shapes, not values. It exists so we can improve detection on documents we have never seen. It says that something shaped like AAA-9999-99999 appeared 37 times after the word “order”: the letters become A, the digits become 9, and no word travels unless it is already on our own built-in list. It carries no value and none of your text. It will be off by default, and the engine itself cannot send it, because it has no network code: it prepares the report and stops there. Sending it is the surrounding app’s job, and only with your permission.
• In the team version: counts and categories. The compliance panel will receive events like “3 person names, 1 Medicare number, masked, policy v4”. An event will carry a timestamp, a device identifier, the counts by category, the policy version and the action taken. It will not carry the text, the values, the destination URL or the prompt. Whether that device identifier resolves to a named person is your decision at rollout: pseudonymous by default, attributable only if you configure it that way.

Deployment surface, in development

The engine is built and you can test it above. The free app, the browser extension, the Windows agent and the compliance panel are not built yet, and nobody is running them in production. This is how they will be deployed and what they will not do, so your IT team can assess them before they exist rather than after they are installed.

• Browser extension, deployed by policy (Chrome, Edge). It will activate only on the AI tools on your allowlist and will not read pages outside it. On those tools it will read what is typed or pasted, in order to clean it before it is sent, and nothing else. No SSL interception, no proxy, no traffic capture, no keylogging, no browsing history.
• Desktop app, with no kernel drivers and no system extensions. It will work on selected text when the user presses a shortcut, so there will be nothing sitting in the middle of your network. What does not install itself into the kernel cannot bring the machine down on an update either.
• Windows agent, with no driver and no kernel component. It will talk to the browser extension and inventory which AI tools are actually in use, which is usually the first thing an organisation discovers it did not know.
• Panel as a container on your infrastructure. It will need no inbound access from us and we will hold no credentials to it. Updates will be images you pull and deploy on your own schedule. What outbound connection it needs, if any, is a design decision we have not closed, and we will publish the answer here before the first deployment rather than after it. The sentence we are not going to write is “we can never see it”: the first serious support case tests that. If a case ever needs us to look at something, you open the access, with your people watching, for as long as you decide, and we get no copy. That belongs in the contract, not only on this page.

Before you roll this out

Recording what staff paste into AI tools is workplace surveillance, and it is regulated. In Australia the rules are state by state: New South Wales requires 14 days’ written notice before computer surveillance under the Workplace Surveillance Act 2005, and Victoria has its own. That obligation is yours, not ours, but discovering it late kills the deployment, so we would rather raise it before you buy than after.

Nonimo is designed to make that argument easier instead of harder. The panel receives counts and categories, never the text, and it can run on pseudonymous device identifiers, so it proves the control was switched on without naming anyone. We will hand you the staff notice template and the internal policy draft along with the deployment. None of this is legal advice, and your own advisers should read it.

What we will not claim

• No accuracy percentage. There is no single honest number. Detection quality is measured against real public documents (official gazettes, tribunal decisions, government forms), separately for each language, because a figure measured in Spanish says nothing about English, and those measurements drive what gets built next. Ask us for the current ones, with the corpus and the date they were taken, and we will send them without putting you through a sales call. Or paste a document you are free to share, a published decision, a blank form, an old letter with the names changed, and measure us yourself.
• No certifications. None, and we are not going to pretend otherwise. No ISO 27001, no SOC 2, no IRAP assessment. We are a new company and ISO 27001 costs more than we have. What we do instead: the engine was reviewed line by line in July 2026, adversarially, by us, which is not an independent audit and we are not going to call it one; we will answer any security questionnaire you send us, in your format; and we will hand your team the engine to review, which is a real offer and it is at the bottom of this page. If a certification is a hard requirement for you, tell us now and we will tell you honestly whether we can get there in your timeframe.
• No customer list. Nonimo is new and nobody is running it in production yet. When someone is, we will ask them before we say so.

This website

A product that exists to stop other people’s data escaping has to apply the same rule to itself, so this is a fair test and here is how to run it.

• Content-Security-Policy in enforcing mode, not report-only, with no wildcards and no external hosts:

  default-src 'self'; script-src 'self' 'wasm-unsafe-eval';
  style-src 'self' 'unsafe-inline'; img-src 'self' data:;
  font-src 'self'; connect-src 'self'; object-src 'none';
  frame-ancestors 'none'; base-uri 'self'; form-action 'none';
  upgrade-insecure-requests

  The only script origin allowed is this domain.
• The three relaxations, before you find them yourself. script-src allows 'wasm-unsafe-eval', without which the engine you just ran would not instantiate and the demo would be a screenshot. style-src allows inline styles, because our build inlines a stylesheet. And img-src allows data: URIs, of which the site currently uses none: it is there so that an inline icon does not break the policy one day. Those are the three, and we would rather list them than write “strict CSP” and leave you to find the asterisks.
• X-Frame-Options: DENY, and a Permissions-Policy that denies camera, microphone, geolocation and payment, because this site has no use for any of them. Our host adds nosniff and strict-origin-when-cross-origin.
• Nothing loads from anywhere but here. A page of this site loads its own document, one stylesheet, its icon and two typefaces, every one of them from this domain. The home page adds a small script and, when you reach the demo, one more request: the engine itself, nonimo_core.wasm, also from this domain and fetched once. Nothing you type causes another request, and no request on any page of this site goes anywhere but here. This site sets no cookies of its own and runs no analytics, not even the free cookieless product our host offers, which we turned down because switching it on injects a script from another server, which is the one thing this page promises we do not do.
• Do not take our word for any of it. Run a header scanner against this domain, or curl -I it, and compare the result with the other security products you are looking at. That comparison is the argument.