A user at your organization wants to run Simpler Redact. This page answers the standard software-review questions, and every claim on it is independently verifiable — that's the point of the design.
Print-friendly — forward or attach as-is to a software-review request.
This page lives at simpler.red/it.
A local desktop application (Windows x64 at v0.1; the command-line tool runs anywhere Node does) that redacts personal information from documents entirely on the user's machine, so the redacted copy — not the original — can be pasted into an AI service or shared externally. There is no server component and no account: it is open-source software (Apache-2.0, © Simpler Terminal Value Systems Pte Ltd). This page exists to give your existing software-review process everything it will ask for — not to argue you should skip that process. If your organization routes tools that touch regulated data (MNPI, NPI, PHI) through third-party or AI-governance review, that review still applies; this page attests to the software's behavior, not to your data-handling policy.
| Runtime network calls, from our code | Zero. Document
processing, review, and export never touch any network. The UI's Content-Security-Policy
forbids external hosts at the platform level, and the only socket the application opens is
127.0.0.1:49331, the local model server. Measured on the shipped installer
rather than asserted from source: scripts/cold-gates.mjs installs the real
artifact, launches it, and reads the operating system's connection table for the whole
process tree — gate 11 fails the release if simpler-red.exe holds any endpoint
outside loopback. |
| Runtime network calls, from the Edge WebView2 runtime | Not zero, and not
ours to switch off. The window is drawn by Microsoft's Edge WebView2 runtime — the same
component Teams, Outlook and most Windows desktop apps use — and its browser process opens
a TLS connection to Microsoft within seconds of launch, before any document is opened. We
found this with the gate above, on our own installer, and could not suppress it: it
survives --disable-background-networking,
--disable-component-update, --disable-sync,
--no-pings, --disable-domain-reliability and a total resolver
block (--host-resolver-rules="MAP * ~NOTFOUND"), which is every documented
Chromium switch for the purpose, and it leaves no trace in the Windows resolver cache
because Edge resolves it over its own DNS-over-HTTPS. Microsoft's tracker carries an open
request for an off switch
(WebView2Feedback
#5224) and no answer. No document content can reach it. The redaction pipeline
runs in the Rust process and never hands text to the webview's network stack; the CSP
forbids the page itself from making any external request; and the connection exists before
a file is loaded. If your policy is no egress at all, block
msedgewebview2.exe outbound at the firewall — the application needs no network
to do its job, which is the airplane test below, and that test is yours to run rather than
ours to promise. |
| How the model arrives | You fetch it; the software never does. The
weights are obtained through your own controlled channel — Google's published Gemma
release — and placed in the model folder. The application then hashes that file and
refuses to start the engine on anything that does not match the pinned SHA-256 byte
for byte (src-tauri/src/lib.rs; scripts/verify-model.mjs
checks the same value offline). One exception, stated because it is the ordinary case at
v0.1: if you run your own model server and leave it listening on the local port, the app
uses that instead of starting its own — it did not choose those weights and cannot hash a
file another process holds open, so it claims no verification, says so on screen, and
records it on the receipt of every document redacted that way. In this
configuration the application's own code makes no outbound network call in its entire
lifetime, and there is nothing to allowlist for it; the WebView2 row above is the
separate, honest exception. |
| A convenience we have not built | v0.1A first-run downloader that fetches those same weights from a project mirror is planned. It does not exist, the mirror is not stood up, and it will always be optional — the hash makes any mirror untrusted-by-design, so sideloading stays fully supported. |
| Telemetry / analytics / updates | None from us. No crash reporting, no
usage analytics, no update pings — verifiable in source today. Updates are manual, from the
release page; there is no auto-update code path to disable. The Edge WebView2 runtime does
start its own Crashpad handler, which writes to
%LOCALAPPDATA%\red.simpler.app\EBWebView\Crashpad on your own machine;
cold-gates.mjs gate 12 fails the release if a cold launch produces a new crash
dump there. |
| Data at rest | Documents are read from and written to the user's chosen locations only. Nothing else is written to disk at all: run history is held in memory for the session and is gone when the process exits. There is no cache, no index, no temp spool of document text. |
| Model runtime | A llama.cpp server process bound to 127.0.0.1
only, supervised by the application and terminated with it. It is the single socket in
the product, and it cannot leave the machine by construction. |
| Privilege | No elevation is required to run, and none is requested. The engine is ordinary user-space code — today you can satisfy yourself of that by reading it. |
Answered as far as an unsigned build allows. Managed deployment, AppLocker/WDAC
publisher rules, SmartScreen reputation and MDM allowlisting all want a signed binary, and
v0.1.0 does not have one: there is no certificate, no publisher identity, and no Team ID to
write a rule against. A hash rule is what your tooling can use today, and the installer's
SHA-256 is printed on the download page and shipped as SHA256SUMS.
v0.1 is Windows x64 only, and it will not be code-signed. bundle.targets
is ["nsis"]; there is no macOS or Linux build to notarize, so there will be no Team
ID or bundle identifier for v0.1, and an earlier version of this page implied otherwise. The
certificate is a company-registry timing problem rather than a software one, and the decision
was to ship without it rather than hold the release — so SmartScreen will show “Windows
protected your PC” and name no publisher. What v0.1 does give your tooling: per-release SHA-256
checksums, a CycloneDX SBOM of every component in the installer, a changelog, and the full
source. A checksum proves the file matches what we published; it does not prove who published
it, and we are not going to dress it up as a signature. When a certificate is issued it applies
to the build after this one, not retroactively to v0.1. Until then, the honest deployment answer
for a regulated environment is that the source is public and auditable and the command-line tool
runs today without an installer at all.
Simpler Redactsimpler-red.exe you will see nothing outside loopback. From
msedgewebview2.exe you will see one connection to Microsoft at launch, and the
WebView2 row above says what it is, why we cannot switch it off, and how to block it. We
would rather you read that here than discover it in your own capture.SHA256SUMS, generated by
scripts/checksums.mjs from the built file, and the installer's own SHA-256 is
printed on the download page.node scripts/cold-gates.mjs --ship-unsigned). The gate checks the signature
state, that the landing page beside the exe does not claim to be signed and does carry that
exact file's SHA-256, that no page on this site prints any other hash, that every declared
licence file shipped inside the bundle, that the app opens a window and produces no crash
dump, that simpler-red.exe holds no endpoint outside loopback, that the build
you downloaded tells you the same thing about the WebView2 runtime that this page does, and
that uninstalling removes the application while leaving your own protected-terms list
alone. Three laws this machine cannot ask are reported as
unrun rather than passed: installing WebView2 where it is absent, a true packet
capture, and a real OS file drop.Every run can export a redaction receipt: tool and engine versions, the pinned model and its SHA-256 (or an explicit statement that no model ran), counts found, masked and deliberately left visible, the reviewer's own decisions named, which detection passes completed, an independent verify-by-extraction result, a fragment check, and an attestation that the application's own process opened no connection outside loopback. It records what was checked and decided; whether that satisfies a given regulator, court, or file requirement is your professionals' judgment — the receipt gives them the facts to make it.
| License | Apache-2.0 (includes an express patent grant), full source available, © Simpler Terminal Value Systems Pte Ltd.
No strong-copyleft (GPL / AGPL / SSPL) components. Five weak-copyleft MPL-2.0 dependencies
are present and unmodified — cssparser, cssparser-macros,
dtoa-short, selectors (all reached via the webview layer) and
option-ext — disclosed because commercial scanners flag MPL and you should hear it
from us first; MPL-2.0's obligations are per-file and attach on modification, and we modify none
of them. The full inventory, with texts, ships as THIRD_PARTY_LICENSES.txt inside the
installer and is generated per release by scripts/notices.mjs. Model weights remain
under Google's Gemma terms (THIRD_PARTY_NOTICES.md). |
| Source & releases | github.com/Simpler-Systems/simpler-redact
— full source and the complete benchmark today.
v0.1Releases will carry binaries + checksums + changelog. |
| Security disclosures | Via GitHub private vulnerability reporting on the
repository (Security tab → Report a vulnerability); see SECURITY.md. |
| Supply chain | Each release ships SHA-256 checksums, a software bill of
materials (SBOM), and a human-readable changelog — npm run release:checksums,
npm run release:sbom (CycloneDX 1.5, built from the graph cargo resolves for
the shipping target rather than from the lockfile, and recording its own exclusions) and
CHANGELOG.md. All three are published beside the v0.1.0 binary. Also: pinned
lockfiles in the repository and no auto-update code path anywhere in the app. |
| What it deliberately is not | No cloud service, no accounts, no browser extension, no Office/Outlook add-ins, no document storage. Scope is one job: local redaction with human review before export. |