Security & Compliance Matrix

1. Local Client-Side Sandbox Architecture

Unlike legacy scanners that upload page DOM trees or visual layout screenshots to distant remote servers for auditing, A11yEngine operates entirely inside your local browser context.

• Zero DOM Retention: The extension audits the active page DOM elements using locally-injected JavaScript routines. No HTML components, page source files, or layout frames are copied, cataloged, or transmitted.
• Secure Settings Storage: Custom options and scanner states are saved locally inside the browser's sandboxed storage layer (chrome.storage.local). They are never shared, synced across devices, or exposed to third-party scripts.
• HIPAA & GDPR Compatibility: By running all audit scans entirely client-side, customer user-data remains sealed inside your active session boundary, supporting organizational HIPAA and GDPR compliance requirements.

2. Local PII Regex Redaction Scrubber

When requesting AI-powered remediation patches, A11yEngine automatically intercepts raw HTML snippets to redact sensitive fields before sending payloads to LLM endpoints. Our regex-scrubber monitors attributes matching keywords like **password, card, cvv, cc, pin, and email**:

cleanHtml = cleanHtml.replace(
  /(password|card|cvv|cc|pin|email)\s*=\s*"[^"]*"/gi,
  '$1="[REDACTED_PII]"'
);