ZTDS Framework Mappings: One Control, Many Frameworks
Each page maps the ZTDS RFC v1.0 client-side sanitization control to one framework or architecture topic, states what the control contributes, and lists what it does not cover. The mappings are written for security, privacy, and engineering teams that need to justify the control to auditors.
Framework Mappings Index
Maps pre-egress tokenization to OWASP LLM02:2025 and states what it does not cover.
Places ZTDS across GOVERN, MAP, MEASURE, and MANAGE for generative AI data privacy risk.
Describes how pre-ingestion sanitization supports Article 10 data governance practices.
Explains data protection by design and security of processing for prompts sent to AI providers.
Shows how 18-identifier removal applies to clinical text sent to language models.
Describes a local gateway that sanitizes JSON-RPC traffic over the MCP stdio transport.
Places sanitization at ingestion, retrieval, and prompt assembly stages of a RAG pipeline.
Compares client-side in-memory sanitization with network proxy and cloud DLP approaches.
Mapping Method
Every mapping follows the same structure: a summary, a control-mapping table, how ZTDS applies, and an explicit list of limits. The four ZTDS invariants are the common vocabulary:
- Invariant 1: zero cleartext network egress.
- Invariant 2: deterministic, reversible surrogate tokens.
- Invariant 3: volatile host RAM isolation.
- Invariant 4: zero external subprocessors.
External facts on these pages were checked against the public sources of each framework owner. Where a framework is voluntary or has no certification scheme, the page says so.
Frequently Asked Questions
What are the ZTDS Framework Mappings?
They are pages that map the ZTDS RFC v1.0 client-side sanitization control to specific frameworks and architectures, such as OWASP LLM02, the NIST AI RMF Generative AI Profile, EU AI Act Article 10, GDPR, HIPAA, MCP, and RAG pipelines.
Do these mappings certify compliance?
No. They describe how a technical control supports a framework as a risk minimization measure. Certification, where a scheme exists, is issued by the framework owner or a regulator.
Where is the normative specification?
The normative text is ZTDS RFC v1.0 at the Standard page, with the IETF draft series linked from the IETF hub.
Related Specifications and Tools
- ZTDS RFC v1.0 Specification — The four invariants referenced on this page.
- Global Regulatory Compliance Matrix — Cross-framework statutory mapping.
- IETF Standards Track Hub — Draft series for the ZTDS protocol.
- Perimeter Scanner — Browser-based egress audit with local receipts.
- AI and RAG Blueprints — Integration recipes for agent and retrieval stacks.