No Record
Security

Security and threat model

Implemented controls, trust boundaries, and residual risk.

No Record · online protocol 2026-08-27.2 · norecord.app

Assets

  • Prompt and response content in browser and request memory.
  • Local IndexedDB conversations, media, project source, settings, and favorites.
  • API-key, credits, and sync recovery secrets shown once.
  • Optional encrypted sync ciphertext and version metadata.
  • Content-free quota and usage records.

Trust boundaries

  • Browser: local storage, privacy map, encryption key, connector bearer tokens, local code frame.
  • Cloudflare Worker: request validation, routing, quotas, aggregate usage, credential verifiers, optional ciphertext.
  • Workers AI: selected model inference. Provider behavior is outside application-storage proof.
  • Outbound MCP: user-supplied HTTPS endpoint; responses return through a bounded gateway.

Smart Privacy limits

The browser replaces email, phone, IPv4, wallet, and credential regex matches with per-request placeholders. Unmatched names, locations, account numbers, and semantic entities are transmitted unchanged. The receipt is evidence of implemented pattern replacement, not proof of anonymity.

Credential controls

  • API keys use norecord_web_<12>_<43>; D1 stores salted, pepper-keyed HMAC-SHA256 verifiers.
  • Credit recovery codes rotate after recovery; sessions expire after 24 hours.
  • Sync recovery codes contain vault ID, authentication secret, and 256-bit AES key.
  • Connector bearer tokens remain in tab memory and are not persisted by No Record.

Code and browser isolation

Local code execution is JavaScript in an iframe with sandbox="allow-scripts". It is not WebAssembly or a cloud container. Browser Run applies domain and private-network guardrails, but acquisition is currently capacity-blocked and controls remain disabled.

Residual risk

  • Cloudflare and network operators can observe IP address, timing, and traffic metadata.
  • Regex minimization has false positives and false negatives.
  • A compromised browser origin can access local state available to that origin.
  • Losing a sync recovery code loses the encryption key; No Record cannot recover it.
  • Outbound MCP servers receive the tool arguments the user invokes.