Data Compliance & Governance
Zero-Knowledge Architecture · Air-Gapped Security Standards
Compliance Philosophy: Privacy by Architecture
SoundShare does not operate traditional cloud storage or intermediate relay infrastructure. All file payloads are transferred directly between peer devices using client-side WebRTC data channels or completely offline optical QR streams. Because our servers never ingest, inspect, log, or store your files, SoundShare inherently satisfies the strictest global data protection and data minimisation mandates.
GDPR (General Data Protection Regulation)
Article 5: Data Minimization
We only process the minimal ephemeral signaling metadata required to establish device-to-device handshakes. Payload data is never collected.
Article 17: Right to Erasure
Because 0 bytes of user files or personal identifiers are stored on servers, there is no persistent data retained that requires deletion requests.
Article 25: Privacy by Design
Our cryptographic handshake negotiates ephemeral P-256 elliptic curve keys (ECDH) and AES-GCM 256-bit encryption locally in the browser runtime.
Article 32: Security of Processing
Data channels use end-to-end encryption with Short Authentication Strings (SAS emojis) to verify connection integrity against MITM attacks.
CCPA / CPRA (California Consumer Privacy Act)
- No Sale or Sharing of Personal Information: SoundShare does not sell, rent, monetize, or disclose personal data to data brokers or third-party advertisers.
- No Cross-Context Behavioral Advertising: SoundShare does not track users across external applications or websites.
- Consumer Rights: Consumers retain complete sovereignty over their data, as all storage actions occur locally on the user's physical device.
Air-Gapped & Offline Transfer Compliance
For high-security, classified, or restricted network environments, SoundShare provides completely offline capabilities via the Visual QR Stream and Hotspot Mode. In these modes:
- Zero internet packets are transmitted — no external Wi-Fi or cellular connection to the public web is required.
- Hotspot Mode establishes a completely local peer-to-peer WebRTC connection using local IP addresses (e.g. 192.168.x.x), bypassing any third-party signaling servers entirely.
- Files and cryptographic keys are compressed locally using the browser's native
CompressionStreamand exchanged via optical QR scans. - The receiver reconstructs the file completely client-side. Fully compatible with air-gapped industrial and compliance requirements.
Third-Party Sub-Processors
| Provider | Purpose | Data Processed | Retention |
|---|---|---|---|
| Ably Realtime | Wormhole WebRTC Signaling | Ephemeral SDP & ICE candidates | Transient (< 60 s) |
| Vercel Inc. | Static Web App Hosting | Standard HTTP logs (IP, User-Agent) | Per hosting policy |
Data Protection & Developer Inquiries
For security disclosures, compliance questions, or technical audits — contact Anurag Bora:
Document Version: 2.1 · Effective: September 2026