Security

Security and sub-processors

What runs where, who else is involved, and what we do not hold. Written for a security reviewer filling in a vendor questionnaire.

Where processing happens

Erasure runs entirely on your machine. The network is involved in exactly three operations, all of which the operator initiates:

• Licence activation, once. Sends the licence key and a machine fingerprint, and nothing else. Air-gapped sites activate offline by exchanging a file, after which the software makes no network call of any kind.
• Counter-signing a certificate, when explicitly asked. Sends the certificate metadata described below.
• Counting a drive — FileX Drive Purge only, which is sold per drive. Before each sanitize it reserves one drive from the pack, and afterwards confirms or releases it. Sends the licence key, the machine fingerprint, a random job number and a SHA-256 hash of the drive's serial number; never the serial, never drive contents. If the service cannot be reached, nothing is sanitized.

Erasing files transmits nothing once activated — no telemetry, no usage counter, no phone-home. You can verify that by running it on a disconnected host after activation; it works identically.

What is transmitted when you certify

Certificate metadata only. Specifically:

• Item count, individual item sizes and total bytes
• The overwrite method, standard, pass count and assurance class
• Start and finish timestamps
• A machine fingerprint and the hostname
• Per item, a SHA-256 of the path — this is the default

Never file contents. Never file bytes. Under any setting. There is no mode, flag or support process that causes file data to be transmitted, because the app contains no code that reads a file for transmission.

Real filenames are transmitted only if an organisation administrator explicitly switches the org into named mode. The mode is decided by the server at reservation time and stamped into the record as privacy.filenames, so a certificate always states what it does and does not reveal. The commit endpoint then re-checks the actual contents: a hashed-mode organisation's submission is rejected if any item name is not a bare 64-character hex digest. A client that lies is refused.

Sub-processors

There are no analytics vendors, no advertising networks, no session-replay tools and no third-party scripts on this site or in the app.

Data residency

The certificate archive and organisation state are held in Cloudflare D1, which has a single primary region fixed when the database is created, with Cloudflare's own replication on top. We will confirm the current primary region in writing on request — ask before you rely on a specific location in a data-transfer assessment, rather than inferring one from where the site happens to respond quickly.

If your requirement is that nothing leaves a particular jurisdiction at all, activate offline and do not counter-sign. An offline-activated installation that never certifies makes no network call at any point in its life, so there is no transfer to assess.

Credentials and sessions

• Organisation API tokens are stored only as a SHA-256 digest. "Shown once" is a property of the system, not a promise we are asking you to trust.
• Session cookie values are likewise stored only as their SHA-256, so a database dump yields no usable sessions.
• Identity is the (provider, subject) pair, never email alone — an address can be reassigned inside a tenant, and matching on it would hand the new holder the previous holder's organisation.
• An unverified email from an identity provider is rejected outright.
• Sessions expire after 30 days.

Cryptography

• Counter-signatures use ML-DSA-65, the post-quantum signature scheme standardised as FIPS 204.
• Record integrity uses SHA-256 over a documented canonical JSON form.
• The operator's own signature and FileX's counter-signature use separate domain-separation contexts, so a signature made in one role cannot be replayed as the other.
• The server recomputes integritySha256 from the submitted record's own contents before signing. We sign the hash we computed, never one a client supplied.
• If the signing key is unavailable, the endpoint fails closed with a 503 rather than archiving something unsigned that looks certified.

Independent verification

The verifier is public, requires no account, and works on any certificate — including ones we never counter-signed. The desktop app verifies offline with no network at all. This is deliberate: evidence that only the issuer can check is not evidence, and it means you are never locked into our continued existence to validate a record you already hold.

Operational limits

Oversized runs are refused rather than truncated. Partial evidence that looks complete is worse than an obvious failure.

Reporting a vulnerability

Email info@cybxsan.com with details and, if you can, a reproduction. We will acknowledge and keep you updated. Please do not test against other organisations' data — ask and we will arrange a test organisation.