Privacy Policy & Cryptographic Airlock

At Aetherion Cyber Systems, Corp., privacy is not a policy concession; it is an immutable cryptographic boundary. We engineer zero-knowledge, local-first software where client data remains strictly under client jurisdiction. We do not monetize, broker, sell, or train foundational public models on enterprise telemetry or candidate information.

1. Default Zero-Retention Architecture

All inputs provided across our public services, including the Aetherion Talent Forge (forge.aetherioncyber.com) and the Sovereign Assessment Lead Capture Engine, operate under our Zero-Retention Guarantee:

• In-Memory Processing: Document parsing (PDF, DOCX, TXT) executes entirely client-side inside isolated Web Workers using jszip and WebAssembly. No resume documents are uploaded to or stored on our servers.
• Client-Side Cryptographic Airlock: Before any inference prompt is generated, our deterministic PII/PHI redaction engine detects and masks 18 HIPAA Safe Harbor identifiers (SSN, phone, email, addresses) and DoD clearance markers with synthetic replacement tokens.
• Volatile Buffer Zeroization: On local desktop engines (C.I.T.A.D.E.L. and C.O.N.C.I.E.R.G.E.), memory pages holding cryptographic material are locked using Windows VirtualLock and wiped with RtlSecureZeroMemory upon completion.

2. Enterprise Telemetry & CMMC 2.0 Compliance

For enterprise defense clients deploying the Sovereign Triforce:

• Air-Gap Integrity: Telemetry streams never egress beyond your designated enclave boundary (Azure GCC High, AWS GovCloud, or on-premises bare metal).
• Hardware-Bound Cryptography: All local database secrets are encrypted via Windows DPAPI-NG sealed to TPM 2.0 Platform Configuration Registers (PCR [0, 2, 4, 11]).
• Default-Deny Access: 100% of API endpoints require explicit cryptographic authentication with ephemeral HMAC-SHA256 tokens.

3. Information We Collect & Purpose

We collect only the minimum information necessary to provide requested services:

• Scoping Inquiries: When you submit a lead for the $15,000 Sovereign Assessment SOW, we record your name, company, business email, and technical use-case in an encrypted Cloudflare KV store solely to contact you and draft the SOW.
• Authentication Codes: Talent Forge OTP codes are hashed via SHA-256 and stored with a 10-minute automatic TTL, purged immediately upon verification or expiry.

4. Your Statutory Rights & Contact

You retain the right to audit, inspect, or request complete deletion of any lead or contact information by writing to our Data Protection Officer at security@aetherioncyber.com.