Data Sovereignty & Local Trust Boundary
StackEngine operates on a Local-First architecture. The primary directive of our platform is to enable security engineers, DevOps specialists, and platform teams to audit candidate infrastructure configurations without risking raw credential exfiltration.
[SYSTEM SPECIFICATION]: LOCAL TRUST BOUNDARY & DATA HANDLING
- • Client-Side Tokenization: The HybridRedactor (v1.0.6) engine redacts detected high-entropy credentials locally in memory (combining Web-Tree-sitter WASM AST parsing and byte-level regex sweeps) before any payload is dispatched outbound.
- • Sterile Transit: Outbound LLM transmissions replace sensitive credentials with deterministic shadow tokens (
__SE_<TYPE>_<HASH6>__), preventing raw secret exposure. - • Zero Persistence: StackEngine does not maintain databases of your proprietary YAML/HCL configurations or repository contents.
- • Local Trust Boundary: Redaction operates exclusively on explicitly routed input (local reverse proxy on
127.0.0.1or terminal STDIN). StackEngine does not capture global OS network egress or inspect unrouted processes. - • Compliance Facilitation: StackEngine is designed to facilitate internal SOC2, ISO 27001, and HIPAA compliance in your own environment. Organizations remain responsible for maintaining their own compliance records and audit trails.
Information We Collect & Data Handling
StackEngine is an independent developer utility matrix. To maintain our local trust baseline while improving software stability, we enforce strict data segregation:
[DATA HANDLING SPECIFICATION]
- • Zero Data Retention (ZDR): StackEngine web servers and relays do not persist your raw infrastructure manifests or remediation patches.
- • Web Portal Telemetry: The offline CLI binary and CI/CD runners contain zero phone-home telemetry. Our web documentation portal utilizes first-party, privacy-preserving visitor analytics for high-level site traffic and response latency benchmarks. This is strictly decoupled from local redactions and does not inspect configuration manifests, source files, or token vaults.
- • Commercial Waitlist Data: When you voluntarily submit your corporate work email for the Commercial Team or Enterprise Private Beta waitlist, this information is strictly segregated from the diagnostic engine and transmitted securely via encrypted protocols directly to the lead architect for technical evaluation and commercial onboarding. Under GDPR and CCPA principles, you may request permanent deletion of your contact information at any time.
Local Tokenization & LLM Sub-processors
When initiating an infrastructure diagnostic audit or running local proxy flows, payloads are sanitized by our local HybridRedactor Engine:
• Local CLI & Reverse Proxy Mode (stackengine):
Runs locally on 127.0.0.1. Outbound LLM requests have secrets redacted into shadow tokens before leaving your workstation. Stream requests are demoted to non-streaming (stream: false) upstream, and tokens are restored into responses in volatile memory before synthesizing SSE chunks back to your editor. The in-memory vault holds a maximum of 100 entries with a 10-minute sliding TTL and FIFO eviction.
• Bring-Your-Own-Key (BYOK) & Web Diagnostic Mode:
Your client environment establishes a direct connection to your designated LLM provider API (OpenAI, Anthropic, or internal endpoint). StackEngine central infrastructure processes 0 bytes of model traffic. Sanitized payloads transmitted are governed by your direct contract with the LLM provider.
Local Storage & Cookies
StackEngine uses browser localStorage strictly for functional client state (e.g., preserving your BYOK API key client-side, theme preferences). We deploy zero cross-site advertising or third-party marketing tracking cookies.
Third-Party Integrations
Static documentation and web assets are distributed via global edge content delivery networks (Cloudflare) to deliver sub-50ms TTFB worldwide. Edge network providers process standard TCP/IP request headers (IP address, TLS cipher suite) strictly for routing and DDoS mitigation.
User Rights & Data Custody
Because we do not store customer configuration files, source code repositories, or personal accounts for public developer utilities, data custody remains within your infrastructure boundary: clearing your browser cache or deleting your local CLI config removes all ephemeral application state.
Enterprise Compliance & Facilitation
For organizations requiring strict network isolation, StackEngine offers commercial CI/CD automation plugins and enterprise air-gapped Docker deployments designed to facilitate internal compliance (SOC2, ISO 27001, and HIPAA) in your private VPC. StackEngine provides software tools to support zero-trust compliance workflows; each customer remains solely responsible for establishing, monitoring, and maintaining its own regulatory certifications and audit trails.
Privacy Inquiries, Data Controller & Direct Architect Contact
StackEngine operates as an independent developer-focused software project led directly by its founder and principal systems architect, who serves as the designated Data Controller under GDPR and CCPA principles (operating as an independent software maintainer pending corporate formalization, and thereafter through its corporate successor). We maintain zero sales intermediaries or outsourced support desks.
For architectural verification, data access requests, or permanent deletion of waitlist and evaluation records, contact the lead architect directly:
All security disclosures and compliance inquiries are reviewed and triaged directly by the Founder & Lead Architect.