CloakShift Connect / Technical reference
How Connect protects and restores information.
This reference describes the current Windows and macOS product, the ChatGPT and Claude browser adapters, the local privacy boundary, and the evidence behind the published measurements.
ChatGPT and Claude in Chrome or Edge · Windows x64, Mac Intel, and Mac Apple silicon · More AI providers being added
At a glance
| Local component | Native Windows or Mac helper reached through Chrome Native Messaging |
|---|---|
| AI-site adapter | ChatGPT and Claude |
| Browsers | Chrome and Edge |
| Operating systems | Windows x64; macOS Intel; macOS Apple silicon |
| Vault encryption | AES-256-GCM, one encrypted vault per conversation |
| Master-key protection | macOS Keychain or Windows per-user DPAPI |
| Attachment limit | Up to 5 files at a time; 20 MB per file |
| Product telemetry | No CloakShift analytics or remote logging endpoint in the extension or local helper; a limited subscription check runs about once per day |
Privacy model
Privacy boundary
With Protection Mode on, the raw draft stays inside an extension-origin secure composer. The local helper detects and replaces supported values. The selected AI page receives the protected result selected for sending.
| Stays on the computer | Can leave the computer |
|---|---|
| Original prompts and files Original-to-protected mappings Encrypted conversation vaults Master key Settings and custom templates Restored transcript content | Protected prompts Protected file copies Normal supported-AI account and browser traffic Website checkout and download requests Passwordless activation and limited subscription/device checks |
The protected copy still goes to the selected AI service and is governed by that service's settings, terms, and retention choices. CloakShift also uses networked services for checkout, downloads, passwordless activation, and subscription verification; those access checks do not include prompts, files, mappings, or restored content.
Architecture
Data flow
- 1
Secure composer
The extension-origin composer holds the raw prompt or local file selection outside the supported AI page while protection is enabled.
- 2
Native Messaging
The thin browser extension sends a transient request to the local helper. The helper does not open a local network listener.
- 3
Local protection
The helper detects supported values, creates aliases or tokens, and stores reversible mappings in the encrypted conversation vault.
- 4
Protected request
Only the protected content approved by the user is placed into the selected AI service's composer or upload flow.
- 5
Local restoration
Supported placeholders in the answer are restored inside extension-origin transcript frames. Restored values are not written back into the AI page.
The helper separately refreshes a signed, short-lived access certificate about once per day. The server stores a one-way hash of the random device secret; the raw device secret and certificate stay encrypted on the computer.
Secure composer → browser extension → local helper → protected request
↓
encrypted conversation vault
↓
local restored viewCurrent support
Compatibility and files
The current release supports ChatGPT and Claude. Each additional AI service needs a separately tested composer, upload path, and restored-transcript adapter; more AI providers are being added.
| Area | Supported or tested | Notes |
|---|---|---|
| AI service | ChatGPT and Claude | Supported adapters; page changes can require compatibility updates. More AI providers are being added. |
| Browsers | Chrome, Edge | Safari and Firefox require separate adapters. |
| Desktop | Windows x64; macOS Intel; macOS Apple silicon | Installer signing and notarization must be verified for each release artifact. |
| Text and structured files | CSV, DOCX, HTML, JSON, Markdown, TXT, XLSX | These formats were included in the V10 native file matrix. |
| Selectable text; local OCR path | V10 scored extracted logical text. OCR and native PDF layout were not part of this 44-case run. | |
| Legacy Office | Not supported | DOC and XLS are not supported by the current engine. |
DOCX and XLSX restoration can be semantically exact without being byte-identical because valid Office packages are rewritten.
Detection scope
Protection profiles
| Profile | Intended use | Important scope note |
|---|---|---|
| Personal profile | Names, email, phone, address, and location with readable output | Ordinary numbers and currency remain available for calculations. On the V10 common-core scope, recall was 99.61% with zero complete-value leaks. |
| Maximum | Broadest supported protection, including contextual numbers, currency, identifiers, and selected structural values | Produced the 99.20% precision and 99.92% recall headline result under strict full-annotation scoring. |
Readable aliases help prose stay natural. Compact tokens such as <PERSON_ad3f> are useful in tables, code, queues, and repeatable workflows. Users can review and edit protected values before sending.
Sensitive local state
Vault and restoration
- Each conversation uses an AES-256-GCM encrypted vault.
- The installed helper protects its master key with macOS Keychain or Windows per-user DPAPI.
- Original values are returned to the extension only when the user explicitly reveals them or requests a local restored view.
- Saved mapping changes retain the prior protected value only so older protected messages can still restore.
- Deleting the local vault removes the ability to restore that conversation.
If an AI deletes, rewrites, merges, translates, or summarizes away an alias or token, CloakShift cannot reliably restore the missing value.
Measured evidence
V10 benchmark
The published comparison result used 44 frozen synthetic prompt and file cases, Maximum protection, strict exact-value scoring, and the real native helper. It contained 24 prompt cases and 20 file cases. A separate native file matrix used 32 cases across eight formats. Product source, fixtures, prompts, tolerances, and measurement runners were hashed before execution. Synthetic sensitive values had zero normalized overlap with the development corpus or V2–V9 sensitive values.
| Metric | Result | Definition |
|---|---|---|
| Precision | 99.20% | Correctly protected values divided by all protected values. |
| Recall | 99.92% | Correctly protected values divided by all annotated sensitive values. |
| F1 score | 99.56% | Harmonic mean of precision and recall. |
| Entity accuracy | 99.35% | Includes declared benign controls as true negatives; not character-level accuracy. |
| Category accuracy | 99.51% | Correct privacy category among matched values. |
| Silent complete-value leak | 0.00% | No complete annotated value remained silently exposed in the run. |
| Restoration recall | 100.00% | Every expected value that was protected restored in the synthetic answers. |
This synthetic benchmark is evidence, not a guarantee. The zero complete-value-leak result does not mean the detector had zero errors: the separate 32-case file matrix had one PDF span miss that did not expose a complete annotated value.
Observed residual errors
- PDF extraction split one currency value and missed part of its annotated span.
- PDF control text produced most file false positives.
- One JSON structural key was protected once in each JSON case.
- One safe phrase in a semicolon-delimited prompt was protected.
Not claimed
Known limitations
- No automatic detector can guarantee that every private value will be found. Human review remains required.
- Distinctive facts and combinations of context can identify a person or organization after direct identifiers are replaced.
- Complex scanned-PDF layout and OCR quality depend on the source document and need review.
- Protected numbers and currency can reduce remote-model calculation fidelity.
- Interactive AI citations, canvases, charts, and generated media do not have dedicated local restored renderers.
- Supported AI page changes can temporarily break the browser integration.
- CloakShift is not a legal opinion, security audit, compliance certification, or substitute for organizational controls.