Privacy Architecture

A short, visual tour of how SumaFlow Digest is built. Everything that touches your documents runs on your phone or tablet. Digest is in open beta, and this page describes the code that is running on testers' devices right now — the same architecture pattern as its sibling, SumaFlow Minutes, with its own independent, open-source privacy core.

The architecture in one diagram

The whole product fits in a single picture. Everything inside the boundary runs on your device. The only path out is an export you review and confirm. The only path in is an opt-in, Wi-Fi-gated download of a public AI model — never your data.

The network manifest

The same contract, in machine terms. This exact manifest ships on the Privacy & architecture screen inside the app, and the privacy regression test in the open-source core enforces it:

outbound_hosts: huggingface.co   # opt-in model download only
content_uploaded: none
telemetry: none
analytics: none
account: none

The seven promises

These promises are the product. They hold in v1 without exception; a violation is a P0 defect.

1. Documents never leave the device. Import, OCR, redaction, extraction, and summarization all run locally.
2. Everything is stored encrypted at rest — files with AES-256-GCM, the document store with SQLCipher. No plaintext is persisted.
3. Zero outbound network calls from the core app carrying user content — no telemetry, no analytics, no "anonymous" launch counters. The one narrow, opt-in exception (model download) is described below.
4. Exports are user-initiated and confirmed — every redaction passes a mandatory review step before it leaves, and every export is recorded in a local, append-only audit log.
5. No account is required. No cloud sync. No login. A biometric/PIN app lock guards the app, so a lost device is not a breach.
6. An open architecture page (this one — and the same screen ships inside the app) explains exactly what runs where.
7. Privacy-critical code is open source, so the claims above are verifiable rather than asserted.

What runs where

There is no server, no account, and no cloud sync. On-device generation uses Gemma 4 E2B via LiteRT-LM where the model is present and RAM allows, and a deterministic extractive engine otherwise. Both run locally; neither transmits your content.

The network posture — the honest part

We disclose this download rather than hide it: shipping multi-gigabyte models inside the app would be worse for users, and pretending the permission isn't there would be dishonest. The permission is present; the line above is exactly what it is for. The app also sets usesCleartextTraffic="false", so any network use must be HTTPS, and disables Android backup (allowBackup="false") so the encrypted database and keys can't be pulled off the device in a backup.

Encryption, in brief

• Files (documents, page images) are encrypted at rest with AES-256-GCM. Nothing is persisted in plaintext.
• Documents, extractions, redactions, and metadata live in a SQLCipher-encrypted database.
• Keys derive from one per-install master key via HKDF into per-purpose subkeys, stored in the Android Keystore (using StrongBox where the device provides one). The master key is non-exportable and never leaves the device.
• Deletion is cryptographic erase. Deleting a document or collection destroys its keys; uninstalling destroys everything.

Redaction: assisted, honestly

Redaction is Digest's hero feature and its most safety-critical one, so its honesty rules are architectural, not fine print:

• Detection is hybrid — deterministic patterns (IDs, account numbers, emails, phones, dates), ML Kit Entity Extraction, and on-device model NER for person and organization names, the known weak point.
• Review is mandatory. Every flagged redaction is confirmed by you before export — better detection never becomes "automatic."
• Image redactions are destructive by design. Exported pages are rasterized and flattened so masked text is destroyed, not hidden under an overlay that could be lifted.
• Completeness is never claimed. Names and unusual formats can be missed; you remain the final authority on what leaves your device.

Open source, so you don't have to take our word for it

The privacy-critical code is published under the MIT license at github.com/SumaFlow-App/sumaflow-digest-privacy-core. It contains the at-rest crypto layer, the key derivation and management code, the network manifest, and the privacy regression test — an executable assertion that the app makes no outbound call to any host outside the huggingface.co allowlist. You can run that test yourself. Digest deliberately does not share a runtime privacy core with Minutes: each app's guarantees are auditable and versioned on their own, so a change to one can never silently alter the other's security surface.

What this design does not protect against

We are explicit about the limits so you can reason about your own obligations:

• A compromised OS or a rooted device with the screen unlocked can read what the running app can read. On-device encryption protects data at rest, not data in use on a hostile system.
• Shoulder-surfing and screen capture by someone with physical access are outside the cryptographic boundary.
• Once you export a document, that copy lives by the rules of its destination. The app makes the export explicit and logs it; it cannot recall it.
• Redaction is assisted, not guaranteed — a missed name in an unusual format can survive review if you approve the page. The review step exists precisely because no detector is complete.
• There is no recovery path: no cloud backup, no key escrow. Lose the device or its keystore and the encrypted data is unrecoverable — the direct cost of having no server.

For regulated professionals

SumaFlow Digest is designed for attorneys, clinicians, HR and finance professionals, and anyone else who handles confidential client documents and cannot upload them to a cloud AI service. An on-device, no-cloud architecture can help you meet your own confidentiality obligations by keeping client content on hardware you control, with no third-party processor in the path. We do not claim certification under, or compliance with, any regulatory or security framework — compliance is a property of your practice, not of an app. And Digest is not legal or medical advice: it assists with your work; you remain responsible for it. What we offer is an architecture whose properties you can verify and reason about against your own obligations.