Security Architecture & Zero-Cloud Proof
Hardware KeyStore & Keychain
2FA TOTP secrets and vault keys are stored using Android KeyStore and iOS Keychain via hardware-backed cryptographic modules.
True Airplane Mode Operation
All engines (ML Kit OCR, PDFium, ID Card alignment, JPEG compressor) run 100% locally. Zero network calls exist in the core flow.
App Switcher Shield (FLAG_SECURE)
Sensitive passport photos, bank scans, and 2FA codes are automatically obscured when switching apps in the recent-tasks carousel.
1. The "Airplane Mode" Verification Test (Try It Yourself)
We believe privacy claims should be verifiable, not taken on faith. Anyone can verify our zero-cloud guarantee in 60 seconds:
Reproducible Verification Protocol:
- Enable Airplane Mode: Turn off all Wi-Fi, Cellular Data, and Bluetooth on your phone.
- Launch IDSnap: Notice the app opens instantly with zero loading spinners or network timeouts.
- Scan an ID Card: Take a photo of a front and back ID card. The edge detection and A4 layout generate immediately.
- Extract Text (OCR): Run text extraction on any document. On-device Latin/Devanagari ML models process the text instantly.
- Check 2FA Codes: Open the Authenticator tab. TOTP codes continue rolling every 30 seconds using the internal hardware clock.
- Inspect Network Logs: Use Charles Proxy, Wireshark, or Android Network Profiler. You will observe exactly 0 bytes transmitted.
2. Cryptographic Storage & Biometrics
IDSnap leverages the platform's native secure enclave for storing sensitive assets:
flutter_secure_storage)kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly)BiometricPrompt & iOS LocalAuthentication. Biometric templates are never visible to app code.3. Clipboard Safety Protocol
When you tap to copy a 6-digit 2FA code or an extracted text snippet, IDSnap flags the clipboard payload with the Android 13+ sensitive content flag (EXTRA_IS_SENSITIVE), preventing clipboard preview leakage. Furthermore, IDSnap automatically schedules a local clipboard purge 60 seconds after copying.
4. Vulnerability Disclosure & Audit Reports
We welcome independent security researchers and privacy auditors. If you identify an issue or would like to submit a report:
Security Team: security@idsnap.app
PGP Key: Available upon email request.
Response SLA: We acknowledge security reports within 24 hours.