AICPA Trust Services Criteria · ISO/IEC 27001:2022 · Zero Subprocessor Chain

Trust Center & Security Controls

Complete mapping of Zero-Trust Data Sanitization (ZTDS RFC v1.0) against AICPA Trust Services Criteria (Security, Confidentiality, Privacy), continuous audit evidence automation, and pre-filled vendor risk questionnaires.

Explore Controls Matrix → Pre-Filled SIG Lite / CAIQ Evidence Binder Architecture Download CISO Memo (PDF) Security Pack (ZIP)

Perimeter Egress

0.00 B

Zero unmasked bytes leave local client execution environment prior to sanitization (Invariant 1).

Subprocessor Liability

0 Chains

No vendor servers touch PII. Software functions as local computational utility (GDPR Art. 28 Exemption).

Memory Scope

Volatile RAM

Mapping tables reside strictly in transient memory. Zero persistence to disk, cookies, or cloud databases.

Continuous Telemetry

SHA-256

Deterministic cryptographic audit receipts generated via CLI for Drata, Vanta, and AuditBoard ingestion.

Normative Compliance Matrix

AICPA Trust Services Criteria & ISO 27001 Mapping

Detailed mapping showing how the four mathematical invariants of ZTDS RFC v1.0 satisfy specific SOC 2 Type II trust principles and ISO/IEC 27001:2022 security controls.

Control ID	Standard / Domain	ZTDS Invariant & Technical Implementation	Audit Verification Evidence	Status
CC6.1	Logical Access Security Security / Boundary Defense	Ephemeral volatile RAM execution boundary. Session mapping tables are created in localized user memory and destroyed on tab closure or process termination. Zero persistent credentials on external infrastructure. Offline Ed25519 cryptographic token (`ZTDS-LIC-v1`) validates authorized node boundaries strictly in memory without licensing phone-home beacons.	Volatile RAM boundary tests; 0 bytes localStorage persistence; Ed25519 cryptographic validation receipt.	SATISFIED
CC6.6	Perimeter Egress Protection Security / Network Boundary	Invariant 1: Zero cleartext network egress prior to local sanitization. Client-side DOM/stream interceptor executes regex/WASM sanitization before socket frames are dispatched to third-party LLM endpoints.	DevTools 5-Step Airplane Mode Audit; Zero socket frames captured in tcpdump/mitmproxy.	SATISFIED
CC6.7	Transmission Data Protection Confidentiality / Encryption in Transit	Deterministic token substitution ([EMAIL_TOKEN_1], [IBAN_TOKEN_2]) replaces high-risk cleartext data before transit over public networks. Upstream LLM providers process strictly de-identified syntactical placeholders.	Egress payload network inspection; OSF Latency Benchmark dataset (10.17605/OSF.IO/5BYJF).	SATISFIED
CC6.8	Malicious Code & Tamper Defense Security / Threat Mitigation	Invariant 3 (Cryptographic & Memory Isolation): In-memory AST heuristic analyzer and sandboxed WebAssembly execution environment operate without dynamic `eval()` or untrusted remote code. Prevents prompt injection payloads from escaping into client contexts. Offline Ed25519 asymmetric signature validation ensures zero runtime tampering with core sanitization profiles.	AST static parser checks; license.test.js anti-tampering verification (Test 3); CSP `script-src 'self'` strict enforcement.	SATISFIED
CC7.2	Vulnerability Monitoring & Patching Security / Vulnerability Management	Continuous vulnerability tracking through automated CI test harnesses (`npx ztds-audit`) and Coordinated Vulnerability Disclosure (CVD). Machine-readable RFC 9116 declaration published at `/.well-known/security.txt` with 24-hour initial triage guarantee and encrypted disclosure via PGP key `0x4E9A2B1C`.	RFC 9116 `/.well-known/security.txt`; Automated CI/CD invariant build checks; CVD ledger.	SATISFIED
CC7.3	Incident Detection & Audit Logs Security / Continuous Monitoring	Automated CLI test suite (`npx ztds-audit`) performs static and dynamic perimeter analysis. Generates tamper-evident cryptographic SHA-256 receipts confirming zero egress and memory isolation.	Cryptographic receipt file: `ztds-audit-receipt.json`; CI/CD GitHub Action artifact.	SATISFIED
C1.1 / C1.2	Confidential Information Classification Confidentiality / Data Governance	Hierarchical entity taxonomy: baseline universal consumer PII plus 25 vertical profiles (HIPAA Clinical PHI, Financial PAN/IBAN, Legal Privilege, Cloud Secrets). Prevents cross-domain entity leakage.	ZTDS Entity Taxonomy SSOT; Automated 25-profile verification test suite.	SATISFIED
P1.1	Notice & Communication of Objectives Privacy / Transparency	Client presentation layer visualizes exact surrogate token replacements in real time before submission, enabling user inspection and granular audit control over sanitized fields.	UI Prompt Preview Inspector; Interactive pipeline debugger.	SATISFIED
P4.1	Retention & Storage Limitation Privacy / Data Minimization	Zero data retention. Raw PII and surrogate mapping tables are never written to non-volatile storage, disks, cloud databases, or log files. Complete memory reclamation upon session end.	Disk write audit logs; In-memory garbage collection verification.	SATISFIED
A.8.11	Data Masking ISO/IEC 27001:2022 / Application Security	Enforces deterministic, reversible tokenization in accordance with organizational access control policies. Protects sensitive data while preserving syntactic context necessary for LLM cognitive reasoning.	RFC v1.0 Invariant 2 mathematical specification; Reversibility proof.	SATISFIED
A.8.16	Monitoring Activities ISO/IEC 27001:2022 / Security Operations	Client execution runtime operates with strict zero-telemetry policy (Invariant 3). No analytical beacons, tracking scripts, or error telemetry transmit runtime metadata or prompt fragments.	Content Security Policy (connect-src 'self' strictly); Network egress audit.	SATISFIED

Legal & Regulatory Shield

Zero-Subprocessor Chain & DPA Exemption Doctrine

Why deploying ZTDS-compliant software eliminates third-party subprocessor risk and bypasses traditional vendor procurement bottlenecks under GDPR Article 28 and HIPAA Safe Harbor.

Traditional Cloud DLP (Nightfall, Purview, BigID) High Procurement Friction

× Server Ingress: Cleartext corporate PII egresses your network to third-party vendor cloud infrastructure for inspection.
× Subprocessor Chain: Vendor acts as GDPR Data Processor (Art. 28), requiring mandatory Data Processing Agreements (DPA), SCCs, and transfer impact assessments (TIA).
× HIPAA Liability: Requires formal Business Associate Agreement (BAA) and vendor audit liability due to unencrypted PHI exposure.
× Procurement Latency: 6 to 12 months for enterprise security questionnaire review, legal negotiations, and penetration test verification.

ZTDS Zero-Trust Data Plane Exempt from DPA Burden

✓ Zero Egress: Sanitization executes 100% locally inside client RAM or private host node. Vendor servers never receive a single byte of customer data.
✓ No Subprocessor Status: Software operates as a local computational utility. Under EDPB guidelines, the provision of local client software does not constitute data processing by a third party.
✓ HIPAA Safe Harbor: De-identification occurs locally before network transmission; external AI endpoints receive only legally de-identified surrogate tokens.
✓ Instant Deployment: Zero legal overhead, zero DPA redlining, zero third-party chain-of-custody audits. Ready for immediate enterprise adoption.

Cross-Jurisdictional Architecture

Statutory Safe Harbors & Regulatory Alignment Matrix

Formal cross-mapping demonstrating how the 4 core mathematical invariants of ZTDS satisfy global privacy statutes, sovereign AI mandates, and federal evidence rules.

EU GDPR · Recital 26 Pseudonymization

Effective De-Identification Threshold

Under Recital 26 and Art. 4(5), data stripped of direct and indirect identifiers ceases to be personal data in the hands of an external recipient lacking the reversal key. When ZTDS confines the mapping table strictly to volatile client RAM, outgoing prompts dispatched to cloud models constitute legally de-identified text.

Satisfies Invariants: 1 (Zero-Egress) & 2 (Reversible)

EU GDPR · Article 28 Zero-Subprocessor

DPA & Subprocessor Chain Exemption

According to EDPB doctrine, software executing exclusively within client-controlled hardware/RAM without transmitting telemetry or cleartext back to the software developer does not constitute third-party data processing. Consequently, no Data Processing Agreement (DPA) or SCCs are statutorily required.

Satisfies Invariants: 4 (Subprocessor Elimination)

EU GDPR · Article 17 Right to Erasure

Vector DB & RAG Inversion Defense

High-dimensional vector embeddings can leak cleartext PII through embedding inversion attacks (Morris et al., EMNLP 2023). Ingesting strictly ZTDS-sanitized surrogate tokens prevents PII from poisoning vector stores (Pinecone, Milvus), ensuring instantaneous Art. 17 compliance by zeroing client mapping tables.

Satisfies Invariants: 2 (Surrogate Tokens) & 3 (RAM)

EU AI Act · Article 10 High-Risk Governance

High-Risk AI System Data Governance

Regulation (EU) 2024/1689 Article 10 mandates that training, validation, and testing datasets must be subject to appropriate data governance practices, specifically privacy protection and mitigation of data leakage risks. ZTDS guarantees zero unmasked egress with entropy bounds (I(X; T) = 0.00 bits).

Satisfies Invariants: 1 (Zero-Egress) & 3 (Isolation)

US HHS · HIPAA Safe Harbor 45 CFR § 164.514

Safe Harbor De-Identification

Under 45 CFR § 164.514, health information stripped of the 18 specified personal identifiers ceases to constitute Protected Health Information (PHI). Because sanitization executes before socket serialization, downstream foundation models receive solely de-identified data. No Business Associate Agreement (BAA) is required.

Satisfies Invariants: 1 (Zero-Egress) & 2 (Tokenization)

US Federal Evidence · FRE 502 Privilege Defense

Attorney-Client Privilege Protection

Submitting sensitive litigation notes or M&A transaction codenames to commercial AI chatbots risks waiver of attorney-client privilege. Deploying an audited, client-side zero-trust redaction mechanism satisfies the statutory "reasonable steps to prevent disclosure" standard under FRE 502(b)(2), shielding work product immunity.

Satisfies Invariants: 1 (Zero-Egress) & 2 (Tokens)

Procurement Speed Pack

Pre-Filled Security Questionnaires (SIG Lite & CAIQ v4)

Copy verified responses for your enterprise Vendor Risk Assessment (VRA), InfoSec review, and Third-Party Risk Management (TPRM) evaluations.

1. Where is customer prompt data and unmasked PII hosted or stored? SIG Lite D.1 · CAIQ DSP-01

Verified Response: Nowhere. Cleartext data and session token substitution mappings reside strictly in the volatile RAM of the local client browser tab or private host process. No customer data is written to disk, databases, persistent cookies, or cloud storage. When the user session closes or the process exits, all state is permanently reclaimed by operating system garbage collection.

2. What data egresses to vendor servers during data sanitization? SIG Lite N.2 · CAIQ IVS-06

Verified Response: Exactly 0.00 bytes. The sanitization and reversible tokenization engine is completely self-contained in local client-side WebAssembly / JavaScript. Verification is empirically proven via the 5-Step DevTools Airplane Mode protocol (network disconnect yields zero failed requests and zero dropped packets).

3. Does the vendor have access to customer encryption keys or token mappings? SIG Lite C.3 · CAIQ EKM-02

Verified Response: No. In multi-user collaborative environments, token maps are encrypted client-side using Argon2id (RFC 9106) and XChaCha20-Poly1305. The vendor maintains zero access to encryption keys or derivation passphrases, adhering strictly to zero-knowledge architectural principles.

4. What third-party subprocessors have access to customer cleartext data? SIG Lite V.1 · CAIQ STA-03

Verified Response: None. Zero third-party subprocessors are engaged in the sanitization pipeline. Because data processing occurs entirely on the customer endpoint prior to transmission, no third-party subprocessor chain of custody exists.

5. How are vulnerabilities disclosed and audited? SIG Lite I.1 · CAIQ SEF-04

Verified Response: In accordance with RFC 9116 (/.well-known/security.txt) and the ZTDS Coordinated Vulnerability Disclosure (CVD) policy. All security advisories are triaged within 24 hours under PGP key 0x4E9A2B1C.

6. How does the software protect against prompt injection or malicious runtime tampering? SIG Lite T.4 · CAIQ TVM-01 · CC6.8

Verified Response: The sanitization engine executes inside an isolated WebAssembly sandbox or pure JavaScript parser with zero dynamic eval() or external script injection vectors. In-memory Abstract Syntax Tree (AST) heuristic linting detects and neutralizes malicious code structures before prompt packaging. Enterprise licenses and custom entity profiles are cryptographically signed via offline Ed25519 asymmetric signatures, preventing in-memory tampering.

7. What is the business continuity risk if ZTDS.ai experiences an infrastructure outage? SIG Lite B.2 · CAIQ BCR-02 · CC7.4

Verified Response: Exactly zero. Conforming ZTDS implementations operate with complete architectural independence. The runtime requires zero live connection to ZTDS.ai servers, APIs, or licensing databases. All core logic, tokenizers, and cryptographic verifiers execute locally on client hardware or private enclaves, guaranteeing uninterrupted operational continuity even during catastrophic WAN disconnects or external cloud failures.

Audit Telemetry Integration

Continuous Evidence Binder Architecture

Enterprise compliance platforms (Drata, Vanta, AuditBoard) require automated, timestamped evidence. The ZTDS audit pipeline generates cryptographically verifiable JSON receipts directly from your CI/CD test runners.

Step 1: Automated Audit

npx ztds-audit --verbose

Static analysis & mock network harness evaluate all 4 invariants during local or CI execution.

Step 2: Cryptographic Receipt

sha256:7f83b1659...

Generates immutable audit receipt containing test hash, timestamp, and 0.00B egress attestation.

Step 3: CI/CD Evidence Vault

ztds-evidence-binder.json

Committed to compliance artifact repository or AWS S3 air-gapped evidence bucket.

Step 4: Auditor Ingestion

Drata · Vanta · A-LIGN

AICPA auditors ingest continuous JSON telemetry directly for SOC 2 Type II observation periods.

ztds-evidence-binder.json (Schema v1.0)

Download JSON

{
  "$schema": "https://ztds.ai/schemas/evidence-binder-v1.json",
  "audit_version": "ZTDS-RFC-v1.0",
  "organization": "ZTDS.ai AI Security Consortium",
  "ecosystem": "BrandMeWeb & PrivacyScrubber",
  "chief_architect": "Ilya Sibiryakov",
  "compliance_frameworks": [
    "AICPA-TSC-2025-SOC2-TypeII",
    "ISO-IEC-27001-2022-A8.11",
    "EU-GDPR-Art28-Exempt",
    "EU-GDPR-Art17-Vector-Immunized",
    "US-HIPAA-Safe-Harbor-45CFR164.514"
  ],
  "test_execution": {
    "timestamp": "2026-09-18T00:00:00Z",
    "runner": "ztds-audit-cli-v1.0.0",
    "audit_hash": "sha256:7343da5fed1858d1aabd60684097dc3e50bc88b10c68efa057c1bde365935739",
    "conformance_result": "PASS_ALL_INVARIANTS"
  },
  "invariant_telemetry": {
    "invariant_1_zero_egress": {
      "measured_bytes_out": 0.00,
      "unmasked_socket_frames": 0,
      "status": "PASS"
    },
    "invariant_2_reversible_tokens": {
      "token_collision_rate": 0.0000,
      "deterministic_restoration": "CONFIRMED",
      "status": "PASS"
    },
    "invariant_3_volatile_ram_isolation": {
      "disk_write_operations": 0,
      "persistent_storage_keys": 0,
      "status": "PASS"
    },
    "invariant_4_subprocessor_exclusion": {
      "external_vendor_apis": 0,
      "subprocessor_count": 0,
      "dpa_required": false,
      "status": "PASS"
    }
  },
  "cryptographic_licensing": {
    "algorithm": "Ed25519",
    "latency_benchmark_microseconds": 111.8,
    "telemetry_heartbeats": 0,
    "status": "AIR_GAPPED_VALIDATED"
  },
  "tsc_controls_satisfied": [
    "CC6.1",
    "CC6.6",
    "CC6.7",
    "CC6.8",
    "CC7.2",
    "CC7.3",
    "C1.1",
    "C1.2",
    "P1.1",
    "P4.1",
    "A.8.11",
    "A.8.16"
  ]
}

Executive Alignment

CISO & External Auditor FAQ

How do we present ZTDS to our AICPA audit firm?

Present ZTDS as an endpoint data-plane security control for Invariant 1 (perimeter egress defense) and Invariant 2 (presentation layer pseudonymization). Submit the pre-filled SIG Lite packet along with your repository's cryptographic ztds-audit-receipt.json artifact to demonstrate automated control testing.

Why does our legal counsel not need to negotiate a DPA?

Under GDPR Article 28 and European Data Protection Board doctrine, a software provider that does not receive, access, or transmit customer personal data is legally classified as a software vendor, not a data processor. No subprocessor relationship is established.

How is continuous compliance maintained across code updates?

Integrate npx ztds-audit directly into your GitHub Actions or GitLab CI pipeline. If any developer introduces a library or network socket that transmits unmasked cleartext data, the CI test fails immediately before production merge.

Does ZTDS replace or complement our existing SIEM / DLP?

ZTDS operates at the presentation and data plane layer (prior to egress), whereas traditional SIEMs monitor network perimeter logs. ZTDS prevents sensitive data from ever reaching the network, eliminating SIEM alert fatigue and DLP false positives.