What stays in your browser, and what (if anything) leaves

Perimeter is local-first by design. This page is the honest, complete account of every place data could move, every safety guard, and how to keep the most private posture.

1 · Local-first guarantee

When you’re signed out and have no AI key set, Perimeter makes zero network calls beyond loading its own static seed JSON from the same origin. There’s no account, no telemetry, no analytics beacon. Your findings, workflow edits, and false-positive verdicts live only in this browser’s localStorage.

localStorage key	What it holds
perimeter.findings.overrides	Per-finding workflow edits (status, owner, suppression).
perimeter.findings.fp	Your false-positive / confirm-real verdicts (suppression memory).
perimeter.audit.log	The append-only audit trail (capped locally).
AI config	Your BYO AI provider URL, model, and key (only if you set one).

To wipe local state, clear this site’s storage in your browser, or clear the AI key from the AI / Settings tab.

2 · Exactly what leaves the browser, and when

Path	Triggers	What leaves	What never leaves
Static seed	Always (page load)	A GET for same-origin seed JSON.	—
Cloud sync	You click “Sync remediation state up” (signed in, Pro)	Workflow fields only: dedup_key, status, owner, suppression reason/expiry.	Raw evidence, hostnames, ports, secrets.
Evidence publish	You click “Publish attack-surface evidence”	De-identified counts, scan-recency date, control refs.	Raw evidence, hostnames, ports, secrets.
BYO-key AI	You set a key AND click “AI fix guidance”	Redacted finding metadata to your chosen provider.	Credentials, raw scan output, hostnames, ports, secret fragments.

If you never sign in and never set an AI key, none of the lower three rows ever happen.

3 · The scan-authorization guard (abuse safety)

Perimeter will not scan a target you haven’t proven you own — both at the server gate and again at the engine boundary as defence in depth. Unverified scopes are scan-blocked; results for unknown or unverified-scope assets are dropped before the pipeline sees them. This prevents the scanner from being weaponized (an SSRF/abuse vector). Full detail in Assets & scan authorization.

4 · AI data minimization (BYO key)

AI remediation guidance is off by default. Perimeter never pays for inference and never proxies your key — your browser calls the provider directly with your own key stored locally. Before any request, the finding is stripped to a minimal, redacted context:

Sent to the AI	Stripped out
title, CVE, severity, CVSS, EPSS, KEV, category, asset_type, exposure	evidence text, raw identifiers, hostnames, ports, secret fragments

When no key is set, the AI feature is disabled and no request fires. Output is labeled “AI-generated · advisory · not authoritative.”

5 · Evidence signing keys

Evidence records are HMAC-SHA256 signed so they’re tamper-evident.

Local tier: a clearly-labeled non-secret demo key signs records so the flow works with no server. This proves a record wasn’t altered after download, but the key isn’t secret, so it doesn’t prove origin.
Cloud tier Deferred / hosted: the real key is a per-tenant secret minted and held in Keystone (envelope-encrypted, never in payloads/logs/plaintext). Signing happens server-side; the browser receives a record it can verify but never holds the key. This proves both integrity and tenant provenance.

See Compliance evidence for the signing/verification flow.

6 · The audit trail

Every mutating action — status change, risk acceptance, owner assignment, rescan, FP feedback, ingest, export, report — is appended to an immutable, append-only audit log (the Audit log tab). Locally it persists in localStorage (capped); in the cloud tier it mirrors to a server-side immutable log for the read-only Auditor role. This is what lets an auditor see who-did-what-when, including which findings were suppressed and why.

7 · Application hardening

Output encoding: all rendered values are HTML-escaped, preventing finding/asset data from injecting markup.
Response headers: the site ships a _headers file with security headers.
No raw secrets in transit: the ingest schema treats extracted / matched_at evidence as sensitive — kept local and redacted before any AI call.
Best-effort cloud module: the cloud tier loads as a separate module; if it fails (offline, blocked, not deployed) the app keeps working locally and never depends on it.

Related: Cloud & entitlements for what publishing involves, and the DosanjhLabs privacy policy for suite-wide data handling.