What actually leaves your machine
Most vendors answer this question with the word “secure” and move on. Below is the specific list instead: every category of data SOVEREIGN handles, whether it crosses your network boundary, and where it goes when it does. If you are running a security review, this page is written for you — and if something here is wrong or missing, tell us and we will correct it.
01 Data-flow disclosure
SOVEREIGN is a Windows desktop application. There is no hyenai account, no licence phone-home during normal use, no analytics SDK, and no telemetry endpoint. We do not operate a server that receives your test data, because no such server exists. The one deliberate exception is BYOK AI features, described in row 8.
| Data | Boundary | Where it lives / goes |
|---|---|---|
| Test cases, suites, steps | stays local | Local JSON in your workspace directory. Git-versionable as code. |
| Application credentials under test | stays local | Encrypted at rest with Windows DPAPI, scoped to your Windows user account. Not recoverable on another machine or by another user. |
| Your AI provider API key | stays local | DPAPI-encrypted on disk. Sent only to the provider it belongs to, over TLS, as that provider's own auth header. Never transmitted to hyenai. |
| Execution results, logs, reports | stays local | Local database and exported report files. Nothing is uploaded. |
| Source code / repository contents | stays local | Read from disk for context. Never transmitted, except as prompt content if you explicitly invoke an AI feature on it (row 8). |
| Screenshots & DOM snapshots | stays local | Captured by the local Playwright browser into your workspace. |
| Usage analytics / telemetry | not collected | None. No analytics SDK is bundled, so there is nothing to opt out of. |
| AI prompt content (BYOK features only) |
leaves machine |
When you use AI test generation, StorySight, or the AI Hub, the relevant context
— your user story, test steps, DOM excerpt, or code snippet — is sent
directly from your machine to the provider whose key you configured
(DeepSeek, Google Gemini, or OpenAI). It does not pass through hyenai infrastructure.
That provider's retention and training policy then applies, not ours.
To eliminate this entirely: configure the AI Hub to use Ollama against a local model. Inference
then runs on your own hardware and this row becomes “stays local.”
|
| Target application traffic | by design | Load testing, API testing, and Red Team scanning send traffic to whatever host you point them at. Only ever the targets you configure. |
| Licence key validation | leaves machine | A one-time check against our licence service when you activate. Transmits the licence key only — no test data, no machine inventory. |
| Update check | leaves machine |
On launch, SOVEREIGN queries the GitHub Releases API to see whether a newer
version exists. This is an outbound HTTPS request to
api.github.com on every start. It sends no test data and no
identifiers we control — but GitHub sees your IP address, and the request
reveals that the machine is running SOVEREIGN.
In an air-gapped environment this call simply fails and is ignored; the application continues normally. |
| Local usage log | stays local |
SOVEREIGN writes a local event log to
%APPDATA%\Sovereign\Telemetry with a per-session GUID, used for
in-app diagnostics. It is written to disk and never uploaded — there is no
transmit path in the code. Crash logs likewise stay in
%APPDATA%\Sovereign\Logs. Delete either folder freely.
|
The short version. If you never enable a BYOK provider, SOVEREIGN's only outbound traffic is licence activation, the update check against GitHub, and whatever targets you deliberately test. If you do enable one, your prompts go to that provider and nowhere else. There is no configuration in which your data reaches hyenai — we run no server that receives it.
02 Threat model
What SOVEREIGN's architecture does and does not defend against. Stated plainly, because a threat model that only lists wins is marketing.
Defended
- Vendor compromise. We hold none of your data, so a breach of ours cannot expose it.
- Network interception of test data. Test content is not transmitted, so there is nothing on the wire to intercept.
- Credential theft from disk by another user. DPAPI keys are scoped to your Windows account.
- Vendor-side data loss. There is no vendor-side copy of your data to lose.
Not defended
- A compromised workstation. Malware running as your Windows user can call DPAPI just as SOVEREIGN does. Local-first moves the trust boundary to your machine; it does not remove it.
- Your chosen AI provider. Once prompt content reaches DeepSeek, Gemini, or OpenAI, their policy governs it. Use Ollama if that is unacceptable.
- Malicious test targets. Pointing the browser at a hostile site exposes you to whatever that site does to browsers.
- Insider access to your workspace. Files are protected at rest, not against someone with your logged-in session.
03 Installer integrity
Read this before you install. The v0.9 beta installer is signed with a
self-signed development certificate (CN=Sovereign Testing Certificate), which
Windows does not trust. SmartScreen and Defender will therefore warn you, and that warning
is legitimate — it means “this publisher is unverified,” not
“this file is safe.” A publicly trusted OV code-signing certificate is on our
list to fix before general availability. Until then, verify the checksum yourself rather
than taking our word for it.
Compare the SHA-256 of your download against the values below. If they do not match exactly, delete the file and contact us.
Sovereign.Setup.exe · 242,194,104 bytes (231 MB) 939EF3298136693FDCE02B43053601C689B4A3C901F8A2827C8B7517A8455134
Sovereign.Setup.msi · 119,590,912 bytes (114.1 MB) 96B01CD21F6211EB70D7E9E57DCED4E112C61D026A51EF9D4A5C41FA33891027
Verify in PowerShell: Get-FileHash -Algorithm SHA256 .\Sovereign.Setup.exe | Format-List
04 Compliance posture
We are a pre-incorporation team shipping a beta. We hold no security certifications, and we will not imply otherwise on a procurement questionnaire. Here is the honest state of things, including where a local-first architecture genuinely helps you.
| Item | Status | Detail |
|---|---|---|
| SOC 2 Type II | Not held | No audit has been performed. Do not list us as SOC 2 attested. |
| ISO/IEC 27001 | Not held | No certification. No ISMS has been formally audited. |
| Data residency | Satisfied by design | Your data never leaves the machine you install on, so it inherits your own jurisdiction. Nothing for us to transfer. |
| GDPR — processor role | Not applicable | We do not process your test data, so we are not a processor for it. If you use BYOK, your chosen AI provider is your processor, under your agreement with them. |
| Sub-processors | Website only | Netlify (static site hosting) and Formspree (contact form delivery). Neither touches the desktop product. |
| Air-gapped operation | Supported | With Ollama configured as the AI provider and licence already activated, the application functions with no outbound network access. |
| Penetration test | Not yet | No third-party assessment has been commissioned. We will publish the report when one has. |
| Source availability | Closed, beta | The desktop application is closed-source today. Enterprise reviewers can request a supervised architecture walkthrough. |
05 This website
hyenai.space is a static site on Netlify with no database and no user accounts. It sends
Content-Security-Policy (including frame-ancestors 'none'),
Strict-Transport-Security with preload,
X-Frame-Options: DENY, X-Content-Type-Options: nosniff,
Referrer-Policy: strict-origin-when-cross-origin, and a
Permissions-Policy denying camera, microphone, geolocation and payment.
These are real response headers, verifiable with curl -I https://hyenai.space.
06 Vulnerability disclosure
If you find a security issue in SOVEREIGN or on this site, please report it before disclosing it publicly. We are a small team, so we will not pretend to a formal SLA — but you will get a human reply.
- Contact: hyenaiintelligence@gmail.com with subject “Security disclosure”.
- Please include: affected version, reproduction steps, and impact. A proof of concept helps enormously.
- Our commitment: acknowledgement within 5 working days, credit in the changelog if you want it, and no legal threats for good-faith research.
- Please avoid: testing against infrastructure that is not yours, and automated scanning of this website — it is static, there is nothing to find.
Last reviewed for SOVEREIGN v0.9 beta. This page describes the beta as shipped; when behaviour changes, this page changes with it. Questions from a security reviewer are welcome and will be answered specifically.