Data Flow
| Deployment |
What happens to your files |
| Cloud sandbox |
Files are uploaded over TLS, processed in-memory, PDF returned, files
deleted immediately. Retention: zero. No file contents are logged at
any point. |
| Docker enterprise |
Files never leave the bank's network. The container runs entirely
on-premise. No outbound connections are made at runtime. |
Data Stored
- Run metadata only: analyst name, timestamp, SHA-256 hashes of uploaded
files, row/column counts, configuration
- Stored in SQLite on the host filesystem (
outputs/vaultdiff.db)
- No file contents, no model data, no customer records are ever persisted
Encryption
| Deployment | In transit | At rest |
|---|
| Cloud sandbox |
TLS 1.2+ (Render / Cloudflare) |
No file data written to disk |
| Docker enterprise |
Bank's own TLS policies apply (within internal network) |
SQLite run log only; bank controls host encryption |
Authentication
- Cloud sandbox: no authentication (demo / evaluation use only)
- Docker enterprise: single-user; bank's own network access
controls and VPN policies apply
- SSO / SAML: available on the enterprise roadmap
Vulnerability Management
- Python dependencies pinned in
requirements.txt with known-good versions
- Security updates delivered as new Docker image tags — no in-place patching required
- Container runs as a non-root user
Audit Trail
Every comparison run produces a SHA-256 stamped, system-generated audit record
embedded in the PDF cover page. The record captures: Run ID, engine version,
UTC timestamp, file hashes, row/column counts, and tolerance configuration.
It cannot be manually altered.
Contact for Security Questions
yuvaraj@vaultdiff.com