Security — Charmey AI CoSec

Security Principles

Four pillars that govern every decision in our architecture.

On-Device AI

No data leaves your infrastructure for AI processing.

All natural language processing runs on local hardware via Ollama.
Zero data exposure to OpenAI, Google, or any third-party cloud AI.
Document scanning and OCR for HKID, passport, and corporate documents occurs on-device.
No training data leakage. Your conversations are never used to improve external models.

End-to-End Encrypted Signing

Multi-factor authenticated signing flows with chain-of-custody audit.

Face ID or biometric authentication required before every signature event.
Telegram Login Widget binding prevents unauthorised link access.
Unique HMAC-signed tokens per document. No two signing sessions share the same credential.
Full audit trail: who viewed, who signed, when, and from which device.

Document Integrity

Immutable record of every version, every signature, every filing.

All signed documents are timestamped and hash-verified.
Documents are stored with AES-256 encryption at rest.
Government-filed copies are mirrored in the client portal for reference.
Automatic versioning. Every edit creates a new document revision.

Infrastructure Security

Hardened deployment with defence-in-depth.

All traffic encrypted via TLS 1.3 with modern cipher suites.
HSTS preloading, X-Content-Type-Options, and X-Frame-Options enforced at nginx layer.
Rate limiting and brute-force protection on all authentication endpoints.
Regular security audits of dependency tree and container images.

Security Features

What this means for you and your clients.

Local AI Only

Your ID scans, company documents, and chat history stay on our hardware. No data ever reaches a third-party LLM provider.

Face ID

Biometric Signing

Face ID verification before every signature. A signed document is cryptographically bound to the person who signed it.

Link Bind

Link Binding

Signing links are bound to the recipient's Telegram identity. Even if a link is intercepted, it cannot be used by anyone else.

Audit

Audit Trail

Every access, every signature, every filing is logged with timestamp and actor identity. Full chain of custody for compliance.

Zero-K

Zero-Knowledge Architecture

We operate on a need-to-know basis. Your documents are encrypted such that even Charmey infrastructure cannot read them without your session key.

Calendar

Compliance Calendar

Automated deadline tracking with proactive notifications. Never miss a CR or IRD filing deadline again.

Technical Details

For the security-conscious. How it works under the hood.

AI Inference: Ollama running on local hardware. Zero outbound connections to cloud AI providers. Inferences complete within the same subnet as your data.
Signing Flow Cryptography: Each signing session generates a unique HMAC-SHA256 token derived from the document ID, recipient Telegram ID, and a server-side secret. Tokens expire after first use or 24 hours, whichever comes first.
Data at Rest: AES-256-GCM encryption for all stored documents and PII. Encryption keys are rotated quarterly and stored separately from the data store.
Data in Transit: TLS 1.3 with modern cipher suites only. HSTS with max-age=31536000 and includeSubDomains.
Authentication: Telegram Login Widget for signers. HMAC-verified callback ensures the identity claim is authentic. Bot admins authenticate via Telegram chat ID whitelist.
KYC Pipeline: Uploaded ID documents are processed locally via OpenCV and Tesseract OCR. No images are ever transmitted to external identity verification services.
Deployment: Hardened Linux with automatic security updates. Fail2ban for SSH, ufw for firewall. All services run as unprivileged users.

Your Data Never Leaves Your Control