CurrentPublic boundary recordUpdated September 28, 2026

Security & data handling / 01

Know the boundary before you share the material.

“Local,” “private,” and “secure” are not interchangeable promises. This page states what each KaldenFrame surface reads, transmits, retains, and deliberately omits—plus what has not been audited, certified, or guaranteed.

Inspect each surface Read security.txt Read the Privacy Policy
01Minimize the input

Use bounded labels, synthetic examples, and public evidence where the decision permits it.

02Keep execution local

The published tools state when processing occurs in the browser or the operator's own runtime.

03Name the non-claim

Controls and hashes are evidence with boundaries—not certificates, signatures, or guarantees.

Data surface map

Six surfaces. Six explicit handling contracts.

Use the row that matches the surface you are actually operating. A local runtime boundary does not describe downloads, email, or the hosting provider.

01 / Public site

Static pages and Cloudflare Web Analytics

Networked by definition
Reads
Ordinary page and asset requests.
Transmits
Request and aggregate traffic data through hosting and analytics infrastructure.
Retains
Operational and aggregate measurements as described in the Privacy Policy.
Does not claim
That visiting a public website is offline or request-free.
02 / Browser-local

Search, Evidence Preflight, brief builders, and fit checks

No query or field-value submission
Reads
Your in-browser search text or entries; Evidence Preflight imports JSON cards up to 64 KB.
Transmits
No search text or field values to a KaldenFrame application server or analytics. Email content moves only when you deliberately send it.
Retains
No site-side query or field persistence. Search state clears on refresh, navigation, or close; Evidence Preflight state clears unless exported.
Does not claim
That page loads, downloads, or a sent email avoid third-party infrastructure.
03 / Local Node.js

Artifact Admission and Attempt Boundary

No runtime network requests
Reads
Artifact Admission reads caller-supplied policy and workspace paths. Attempt Boundary reads a supplied plan, executes named commands, and hashes explicitly protected paths.
Transmits
Nothing automatically at runtime.
Retains
Only requested local outputs; Attempt Boundary records command-output byte counts and SHA-256 digests without storing output content in its receipt.
Does not claim
Sandboxing, authenticity, source truth, or safe behavior for an operator-supplied executable plan.
04 / Local Python

Private Python implementations: two withdrawn, three current

No runtime network requests
Reads
Local Input Receipt reads one selected regular file or directory and rejects symbolic links. Tabular Shape Receipt reads one local CSV or JSON Lines file and retains its basename, exact SHA-256, ordered column names, and aggregate structural observations without row values. Replay Input Preflight reads contract-declared contained paths and never executes a replay. The Auditor reads selected local CSV or JSON Lines values and its contract. Feature Freezer reads policy plus values-free column-schema metadata—not dataset rows or target values.
Transmits
No uploads or telemetry at runtime.
Retains
Local Input Receipt emits a source display name, portable relative paths, byte counts, SHA-256 identities, and limits without absolute paths or contents. Tabular Shape Receipt emits source basename, exact source SHA-256, ordered column names, and value-redacted structural counts. Replay Input Preflight emits relative paths, byte counts, identities, statuses, and issues. The Auditor emits aggregate evidence without row values, entity values, row timestamps, or absolute source paths. Feature Freezer emits declared names, roles, types, decisions, reasons, and byte identities.
Does not claim
Provenance, completeness, universal leakage proof, factual source data, correct operator declarations, compliance, safety, or fitness.
05 / Human review

Release Boundary Review

Public evidence only
Reads
One public GitHub repository, one named release path, one decision, and accepted non-sensitive context.
Transmits
Intake and the delivered report by email; public repository records remain hosted by their providers.
Retains
Accepted intake, working notes, delivered report, and transaction records as reasonably necessary.
Does not accept
Credentials, secrets, private source, internal logs, customer or regulated data, or private-system access.
06 / Email

Contact, purchase, support, and disclosure

Your send action controls transmission
Reads
The browser may assemble a plain-text draft; your email client receives it only when you open that route.
Transmits
Your message through your email provider and KaldenFrame's email service only after you send it.
Retains
Communications and related records as reasonably necessary for delivery, support, security, accounting, or disputes.
Do not send
Passwords, authentication codes, API or private keys, full card numbers, unauthorized customer data, or private strategy and research.

Public-site controls

Five response controls, visible on the wire.

These are deployed HTTP response policies for the public site. They reduce particular browser-side risks; they are not a substitute for application review or a guarantee against compromise.

Content-Security-Policy

Restricts default resource origins, framing, objects, forms, images, scripts, styles, fonts, and connections; permits the site and Cloudflare analytics where named.

Permissions-Policy

Disables camera, geolocation, microphone, payment, and USB browser capabilities for the site.

Referrer-Policy

Uses strict-origin-when-cross-origin to limit cross-origin referrer detail.

X-Content-Type-Options

Uses nosniff to prevent MIME-type guessing by supporting browsers.

X-Frame-Options

Uses DENY; the CSP also sets frame-ancestors 'none'.

/.well-known/security.txt

Publishes the security contact, expiry, language, and canonical disclosure record in the RFC 9116 location.

Inspect the live record

Integrity boundary

A hash identifies bytes. It does not appoint a trust authority.

KaldenFrame publishes SHA-256 values for exact distributions and selected evidence artifacts. Matching a hash can show that two byte sequences are identical.

  • Not a digital signature
  • Not an authorship or provenance attestation
  • Not a trusted timestamp
  • Not proof that source data or a claim is true
  • Not proof that the bytes are safe or fit for a decision

Vulnerability disclosure

Report safely. Do not create a second exposure.

The published security contact authorizes reporting, not intrusive testing, service disruption, social engineering, or access to non-public data.

Include

A minimal, reproducible report

  • Affected product, version, or public URL
  • Observed impact and conditions
  • Safe reproduction steps
  • Minimal synthetic evidence where possible
Exclude

Sensitive or unauthorized material

  • Credentials, secrets, or private keys
  • Customer or regulated data
  • Private source or internal logs
  • Data obtained beyond your authorization
Current program

A contact route, not a bounty

KaldenFrame does not currently advertise a bug-bounty program, payment, safe-harbor terms, service-level response time, or permission for intrusive testing.

Email a security report

What is not being claimed

Controls are evidence. They are not certification.

Security FAQ

Resolve the handling boundary before you proceed.

The visible answers and structured FAQ publish the same claims. Product-specific documentation and accepted written scope control where a surface differs.

01Does the public website receive the text I enter into its local tools?

No. Global site search, Evidence Preflight, the contact brief builder, and the product and service fit checkers process their fields in the browser. They do not submit search text or field values to a KaldenFrame application server, persist them on the site, or include them as analytics fields. Loading pages and assets still produces ordinary request data, and sending an email hands its contents to the email providers involved.

02Which downloadable tools make runtime network requests?

Artifact Admission and Attempt Boundary run in local Node.js environments without network requests. The preserved withdrawn Local Input Receipt and Tabular Shape Receipt implementations plus the current Replay Input Preflight, Temporal Boundary Auditor, and Target-Blind Feature Freezer implementations run in local Python environments without runtime network requests, uploads, or telemetry. Downloading packages, schemas, or examples still creates ordinary requests to the hosting service.

03What data does each private-delivery tool read and retain?

Local Input Receipt reads one selected file or directory and records source display name, portable relative paths, byte lengths, SHA-256 identities, and limits without recording absolute paths or contents. Tabular Shape Receipt reads one local CSV or JSON Lines file and retains source basename, exact source SHA-256, ordered column names, and aggregate structural observations without raw rows, samples, extrema, quantiles, frequent values, individual row hashes, or absolute paths. Replay Input Preflight reads contract-declared contained paths and records relative identities without executing a replay. Temporal Boundary Auditor reads operator-selected local CSV or JSON Lines data and its contract, then omits row values, entity values, row timestamps, and absolute source paths from reports. Target-Blind Feature Freezer accepts policy plus values-free column-schema metadata and does not read dataset rows or target values; its manifest retains declared names, roles, types, decisions, reasons, and SHA-256 identities.

04What may I send for a Release Boundary Review?

Send one public GitHub repository URL, one named release workflow or path, the decision to evaluate, and non-sensitive context. The fixed review uses public evidence only. Do not send credentials, secrets, private source code, internal logs, customer data, regulated data, or private-system access.

05Does a published SHA-256 value prove authenticity or correctness?

No. A SHA-256 value identifies exact bytes and supports later comparison. It is not a digital signature, provenance attestation, trusted timestamp, authorship proof, source-truth guarantee, or evidence that the underlying claim is correct.

06Has KaldenFrame Labs been externally security-audited or certified?

No external security audit, penetration test, compliance certification, or compliance attestation is claimed for the site or products. KaldenFrame does not currently advertise a bug-bounty program and does not claim that any system is vulnerability-free, universally secure, safe, or fit for every use.

Choose the right record

Security boundary, privacy practice, or product operation?

This page summarizes controls and data movement. The Privacy Policy governs information handling; product documentation describes operation; the disclosure record names the reporting route.

Privacy Policy Product documentation security.txt