Security & Privacy Architecture

1. Security by Architecture, Not by Promise

Many software vendors ask users to "trust" their cloud privacy policies while silently collecting document metadata, telemetry, and tracking identifiers. At NIRZURA Labs, we take a different stance: The most secure data transmission is the one that never occurs.

Our software is architected so that document bytes never touch an external network interface. When you use Paprwork:

• Documents are read directly into host operating system RAM.
• Transformations execute locally via native CPU instructions.
• Output files are written directly back to local storage.
• No network sockets are opened to transmit document contents, file names, page counts, or passwords.

2. Cryptographic Release Verification (SHA-256)

To protect users from supply-chain tampering, unauthorized mirror modifications, or transmission corruption, every official release of NIRZURA Labs software is published alongside an authoritative cryptographic SHA-256 checksum.

Users can verify binary authenticity anytime using standard operating system utilities or our on-device Web Crypto verifier:

# Verify SHA-256 on Windows (PowerShell)
Get-FileHash -Algorithm SHA256 .\Paprwork-Portable-2.0.0.exe

# Verify SHA-256 on Linux / macOS
sha256sum Paprwork-Portable-2.0.0.exe

If the calculated hash matches the published checksum on our Downloads portal, the binary is confirmed identical to the official release build with bit-level precision.

3. Ephemeral In-Memory Execution & Memory Hygiene

Security inside local software requires strict memory isolation:

• Volatile Buffers: All PDF stream decompiling, image rendering, and text editing take place in volatile heap memory.
• Zero Retention: When you close a tab or exit the application, memory buffers holding file bytes are explicitly zeroed before dereferencing.
• No Background Caching: No hidden shadow copies or unencrypted caches are written to temporary system directories.

4. Zero Telemetry & Anti-Tracking Commitment

We do not bundle analytics SDKs, telemetry monitors, advertising identifiers, or tracking pixels into our desktop applications:

• We do not record what files you open.
• We do not record which tools you use or how frequently you use them.
• We do not require user accounts, emails, or phone numbers.
• The application functions 100% identically when your machine is completely disconnected from the internet.

5. Responsible Vulnerability Disclosure Policy

We welcome responsible security research and vulnerability reports from the independent engineering and cryptographic community.

If you believe you have identified a security vulnerability, buffer handling flaw, or cryptographic weakness in NIRZURA Labs software, please submit your findings to:

6. Accurate Claims Policy

We avoid unsubstantiated marketing statements. We do not claim "100% unhackable" or represent that independent audits exist where they do not. Our commitment is rooted in mathematically verifiable cryptographic architecture, open disclosure of third-party dependencies, and engineering transparency.