Security & Privacy

Last Updated: 2026-02-12

Overview#

cloak.business is built for organizations that handle sensitive data and need strong guarantees about how that data is processed. The platform is ISO 27001:2022 certified and designed from the ground up to minimize data exposure, eliminate unnecessary retention, and keep all processing within the European Union.

Data Handling#

Zero-Storage Architecture#

• Text is processed in memory only — no original text is written to disk, logged, or stored
• Images are processed transiently — uploaded images are held in memory during processing and discarded after the response is sent
• No detection results are retained — once results are returned to the client, they are not stored on the server
• No user data is used for training — NLP models are not fine-tuned, retrained, or improved using customer data

What We Store#

The only data stored persistently is:

• Account information — email address, hashed password, subscription status
• Token usage records — aggregate usage counts for billing (no text content)
• Session metadata — for reversible anonymization (encrypted tokens only, no original text)

Encryption#

All communication between clients and the server is encrypted via TLS. The Encrypt anonymization method uses AES-256-GCM, an authenticated encryption standard that provides both confidentiality and integrity verification.

Authentication#

• Session-based authentication — Secure, server-side session management for the web application
• API key authentication — For MCP Server and REST API integrations
• Optional two-factor authentication (2FA) — Additional security for user accounts
• Zero-Knowledge password handling — Passwords are hashed before storage; the server never has access to plaintext passwords

NLP Model Privacy#

cloak.business uses three NLP engines for detecting unstructured PII (names, locations, organizations):

• spaCy (Explosion AI) — 25 languages
• Stanza NER (Stanford NLP) — 7 languages
• XLM-RoBERTa (Meta AI) — 16 languages

All three models run entirely on cloak.business's own servers in Germany. This is a critical privacy guarantee:

• No text is sent to Meta, Google, Stanford, Explosion AI, or any other third party
• The models are static — they are not updated or trained with user data
• Model inference happens in memory alongside the rest of the detection pipeline
• There is no external API call during processing

cloak.business is not a wrapper around third-party AI services. The NLP models are deployed and operated on infrastructure we own and control.

EU Data Residency#

• All processing takes place in a German data center
• No data leaves the EU at any point during analysis or anonymization
• No third-party cloud providers are involved in the processing pipeline
• Server infrastructure is located in Germany and operated under German and EU data protection law

Compliance#

GDPR Alignment#

cloak.business supports GDPR compliance in two ways:

1. As a tool — Helps organizations anonymize personal data in documents, enabling safe data sharing, analytics on anonymized datasets, and compliance with data minimization requirements.

2. As a service — The platform itself is designed to process minimal data, store nothing beyond what is required for billing and account management, and keep all processing within the EU.

Penetration Testing#

cloak.business undergoes regular external penetration testing using industry-standard tools and frameworks.

Testing covers: network security, external firewall analysis, service vulnerability scanning, OWASP Top 10, SSL/TLS analysis, DNS security, SSH hardening, privilege escalation, and compliance (ISO 27001, CIS Benchmark, NIST 800-53).

Responsible Disclosure#

If you discover a security vulnerability, please report it to security@cloak.business. We take all reports seriously and will respond promptly.