The brief for IT & InfoSec reviewers

A user at your organization wants to run Simpler Redact. This page answers the standard software-review questions, and every claim on it is independently verifiable — that's the point of the design.

Print-friendly — forward or attach as-is to a software-review request. This page lives at simpler.red/it.html.

Read this first: the engine, the benchmark and the full source are published and runnable today. The desktop application has not been released — there are no installers, no code-signing certificate and no download mirror, so the questions a review normally asks about a binary cannot be answered yet, and this page does not pretend otherwise. What follows describes software you can read and run; the few forward-looking lines carry a v0.1 marker and are commitments, not descriptions.

What it is

A local desktop application (Windows/macOS/Linux) that redacts personal information from documents entirely on the user's machine, so the redacted copy — not the original — can be pasted into an AI service or shared externally. There is no server component and no account: it is open-source software (Apache-2.0, © Simpler AI). This page exists to give your existing software-review process everything it will ask for — not to argue you should skip that process. If your organization routes tools that touch regulated data (MNPI, NPI, PHI) through third-party or AI-governance review, that review still applies; this page attests to the software's behavior, not to your data-handling policy.

Network behavior — the whole story

Runtime network calls	Zero. Document processing, review, and export never touch any network. The UI's Content-Security-Policy forbids external hosts at the platform level.
How the model arrives	You fetch it; the software never does. The weights are obtained through your own controlled channel — Google's published Gemma release — and placed in the model folder. The pinned SHA-256 is verified before the file is ever loaded (`scripts/verify-model.mjs`, auditable today). In this configuration the product makes no outbound network call in its entire lifetime, and there is nothing to allowlist.
A convenience we have not built	v0.1A first-run downloader that fetches those same weights from a project mirror is planned. It does not exist, the mirror is not stood up, and it will always be optional — the hash makes any mirror untrusted-by-design, so sideloading stays fully supported.
Telemetry / analytics / updates	None. No crash reporting, no usage analytics, no update pings — verifiable in source today. Updates will be manual, from the release page; there is no auto-update code path to disable.

Runtime behaviour on the endpoint

Data at rest	Documents are read from and written to the user's chosen locations only. Nothing else is written to disk at all: run history is held in memory for the session and is gone when the process exits. There is no cache, no index, no temp spool of document text.
Model runtime	A llama.cpp server process bound to `127.0.0.1` only, supervised by the application and terminated with it. It is the single socket in the product, and it cannot leave the machine by construction.
Privilege	No elevation is required to run, and none is requested. The engine is ordinary user-space code — today you can satisfy yourself of that by reading it.

Deployment, signing and application control

These questions cannot be answered honestly yet, so this page does not answer them. Managed deployment, AppLocker/WDAC publisher rules, SmartScreen reputation, MDM allowlisting and installer paths all describe a signed binary — and no binary has been released. There is no certificate, no publisher identity, and no Team ID to write a rule against.

When the v0.1 binaries ship, this section gains the specifics your tooling needs: publisher name and certificate thumbprint, the macOS Team ID and bundle identifier, install paths, and per-release SHA-256 checksums. Until then, the honest deployment answer for a regulated environment is that the source is public and auditable and the command-line tool runs today without an installer at all.

Verify it yourself — don't take this page's word

Airplane test: disable networking after setup; every function works. (Processing was never remote.)
Wire audit: run any network monitor (Wireshark etc.) during a redaction session — observe zero outbound connections.
Source audit: the codebase is deliberately wire-auditable — grep the repository for network calls; the only one is the localhost model socket and the single setup fetch.
Artifact audit: the model hash is pinned in-app, shown on screen, and written into each run's exportable receipt alongside the tool and engine versions. v0.1Binary checksums will be published with each release.
Accuracy audit: the detection benchmark — corpus, hand-built ground truth, and runner — ships in the repository and re-runs with two commands; the measurement record is public at simpler.red/research.

Audit artifacts your users get

Every run can export a redaction receipt: tool and engine versions, the pinned model and its SHA-256 (or an explicit statement that no model ran), counts found, masked and deliberately left visible, the reviewer's own decisions named, which detection passes completed, an independent verify-by-extraction result, a fragment check, and a zero-outbound-connections attestation. It records what was checked and decided; whether that satisfies a given regulator, court, or file requirement is your professionals' judgment — the receipt gives them the facts to make it.

Plain-language regulatory framing (not legal advice)

HIPAA: a BAA covers vendors who receive PHI. This software receives nothing — there is no data flow to a vendor, because there is no vendor endpoint.
GLBA / banking (OCC, FDIC): no NPI leaves the endpoint. The tool is software under your existing endpoint controls; the Safeguards question is about your device posture, which this app does not change.
SEC / Reg S-P (RIAs): same logic; run receipts and the optional local history can support books-and-records practices if the user includes them in their firm's backup routine.
Separate question: approving this app and permitting redacted output to be pasted into an external AI are different policy decisions at most organizations — clear both.

Project facts

License	Apache-2.0 (includes an express patent grant), full source available, © Simpler AI. No embedded copyleft (AGPL/GPL) components. Model weights remain under Google's Gemma terms (`THIRD_PARTY_NOTICES.md` in the repository and beside the mirror).
Source & releases	`github.com/SimplerAI/simpler-redact` — full source and the complete benchmark today. v0.1Releases will carry binaries + checksums + changelog.
Security disclosures	Via GitHub private vulnerability reporting on the repository (Security tab → Report a vulnerability); see `SECURITY.md`.
Supply chain	v0.1Each release will ship SHA-256 checksums, a software bill of materials (SBOM), and a human-readable changelog — none of the three exists yet, as there are no releases. What exists today: pinned lockfiles in the repository and no auto-update code path anywhere in the app.
What it deliberately is not	No cloud service, no accounts, no browser extension, no Office/Outlook add-ins, no document storage. Scope is one job: local redaction with human review before export.