Security overview

SureMatters is built local-first. This is the short version of how the products work and how you can check it yourself.

This is the public summary. The full Security Architecture — component detail, key management, incident response — is available to buyers on request from policy@surematters.com.

Where your documents live

On your own computer. SureRedact runs there entirely, and so does SurePrepare. (A helper service for source systems SurePrepare cannot read directly is designed but not yet built; when it ships it will run in your own cloud, under your own credentials.)

Your documents do not transit our infrastructure under any tier or any add-on, and we do not send them to OpenAI, Anthropic, or any other AI service.

Four commitments, built into the architecture

These are structural facts, not policy assertions.

1. You make every final redaction decision. There is no automatic “apply all” path in the software. Every applied redaction is an explicit operator action, recorded with timestamp, identity and before-and-after state.
2. Your documents stay inside your boundary. No code path sends document content to us or to any AI service.
3. You control what leaves your machine. The only thing transmitted is an error report when something goes wrong, and you can switch it off — you are asked on first run. Operational records stay on your machine, where you can see them and clear them.
4. AI assistance in anything we send you is labelled, and a named person has reviewed it.

What we run

Very little, deliberately. A static website, and the signing keys for our releases. We do not operate a telemetry service, a licence-verification service, an update service or a customer portal. Licences are issued by hand; you download releases from the website when you choose to.

There is very little attack surface on our side, because there is very little of our side.

Integrity you can check

• Releases are cryptographically signed — Apple Developer ID on macOS, Authenticode on Windows — so your operating system verifies origin and integrity before the software runs.
• Detector bundles and licence files are signed with separate keys, held in a hardware-backed key service, and verified locally.
• The decisions log is append-only during review and sealed into a tamper-evident hash chain when a disclosure pack is produced. Any alteration to a decision after disclosure is detectable, and the pack carries everything needed to verify the chain without us.

How to verify it yourself

• Watch the network. On your own infrastructure, confirm the only outbound traffic goes to our error-reporting provider — or nothing at all, if you have switched it off — plus any connector you configured yourself. Nothing to us. Nothing to any AI service.
• Read the local log. Settings shows every operational event the software has recorded on the machine, with a button to clear them.
• Recompute the audit trail. Verify a disclosure pack’s hash chain end to end, from the first entry to the value published in the pack. It verifies without us and without trusting us.
• Inspect the source, under an appropriate agreement, on request.

Drafted with AI assistance and reviewed by a named person, per our AI Policy. For the full Security Architecture document, write to policy@surematters.com. Accuracy concerns to security@surematters.com.