Local-first on-access inspection
All file scanning, unpackers, and heuristic evaluations run natively on your machine as a secure Windows service. Your local CPU processes checks—your files are never streamed to remote inspection clusters.
Zero-Content Ingestion Architecture
Engineered for endpoint defense. Never for harvesting your data.
SafeLayer AV operates on an uncompromising zero-content-ingestion philosophy. Your private files, documents, photos, and codebases never leave your PC. Threat analysis is executed locally on your endpoint, and our telemetry is strictly limited to malware signatures, cryptographic hashes, and vulnerability indicators.
File Exfiltration
0 Bytes
Scan Execution
100% Local
Reputation Checks
SHA-256 Only
Privacy Specification
Security Without Surveillance
Antivirus software must protect your system, not spy on it. SafeLayer is architected so our servers have zero capability to inspect or reconstruct your personal documents or private communications.
Guaranteed Scope
MALWARE & VULNERABILITY TELEMETRY ONLY
Data Boundaries
An impenetrable line between your private files and security telemetry.
We enforce a strict separation of concerns. SafeLayer AV does not process, inspect, or exfiltrate user files. We only process technical telemetry required to detect, quarantine, and neutralize malicious code.
What Never Leaves Your Device
SafeLayer AV possesses zero access mechanisms to ingest, index, or transmit your personal and commercial information:
Personal & Business Documents
Word documents, spreadsheets, PDFs, slide decks, emails, and private text files are never opened, read, or uploaded to any cloud server.
Source Code & Intellectual Property
Repositories, build outputs, configuration files, and proprietary source code remain strictly local. SafeLayer never harvests intellectual property.
Personal Media & Archives
Photos, audio, video recordings, and personal archive downloads are excluded from data collection and never transmitted off your device.
Credentials, Keys & Private Tokens
SafeLayer never accesses or stores passwords, SSH keys, browser cookies, keystrokes, or autofill vaults.
Personal Browsing History
We do not track web browsing history or search habits. Network protection only intercepts connections to known malicious C2 IP addresses and phishing domains locally.
What SafeLayer Telemetry Covers
Telemetry is strictly confined to verifying threat integrity, blocking exploits, and updating defense databases:
Cryptographic Binary Hashes (SHA-256)
One-way mathematical fingerprints of unfamiliar executable binaries checked against global threat intelligence feeds. Hashes cannot be reversed to extract file content.
Malware Signatures & Rule Matches
Matched threat classifications, malicious pattern definitions, and ransomware heuristic indicators used to explain why an arrival was stopped.
Process Execution Anomalies
Technical telemetry indicating malicious runtime behavior, such as unauthorized process injection, process hollowing, or shadow copy deletion attempts.
Vulnerability & Engine Status
System build version, signature database timestamps, and software health metrics necessary to deliver timely security feed updates.
C2 & Phishing Network Blocks
Event metadata when an outbound connection to a verified botnet command-and-control server or known malicious domain is blocked locally.
Architecture
How privacy is enforced by code.
Privacy in SafeLayer AV is not a marketing promise—it is enforced through local-first process isolation, cryptographic hashes, and strict system permissions.
One-way cryptographic reputation
When second-opinion intelligence is needed for an unfamiliar binary, SafeLayer queries external reputation feeds using only an irreversible SHA-256 hash. The cloud never sees the file body or its author.
Hardware-isolated local quarantine
Held and quarantined threats are moved to an encrypted local directory under mode 0600 permissions. Quarantined files remain under your sole custody on disk.
Automated PII redaction in logs
Rotating logs and exported diagnostic bundles scrub directory paths, redact API keys, and sanitize environment data before anything can be shared.
Handling Register
Technical data handling matrix.
Complete transparency into every data category, why it exists, where it lives, and when it expires.
| Data Category | Security Purpose | Processing & Storage | Retention & Lifecycle |
|---|---|---|---|
| User Documents & Files | Local security verification before execution | 100% on-endpoint RAM & disk. Never uploaded or transmitted. | Remains in original location or user-managed local quarantine vault. |
| Cryptographic Hashes (SHA-256) | Threat reputation lookup against threat databases | One-way cryptographic hash queried over TLS; zero file contents. | Cached locally in safelayer.db with short TTL; never tied to identity. |
| Malware Detections & Signatures | Threat containment, audit timeline, and incident alerts | Logged locally in SQLite WAL database on the endpoint. | Rolling FIFO buffer capped at 100 entries. Can be purged anytime. |
| C2 & Phishing Network Events | Blocking botnet communication and malicious domains | Evaluated and logged locally via DNS and socket filters. | Stored locally on endpoint. Never shared with advertising networks. |
| Vulnerability & Engine State | Retrieving incremental signature updates (conditional-GET) | Anonymous engine and DB timestamp sent to update mirrors. | Ephemeral session data; no persistent user profiling. |
| Diagnostic Support Bundles | Troubleshooting product errors upon explicit user request | Automated PII scrubbing of paths, watch folders, and keys. | Generated locally only upon user action; user maintains full custody. |
Our Ethical Pledge
Zero monetization. Zero AI scraping. Zero surveillance.
Modern users deserve cybersecurity that defends their endpoints without turning their intellectual property into someone else's training corpus or advertising asset.
Zero data monetization or advertising
SafeLayer AV is an enterprise cyber defense platform funded solely through software subscriptions. We do not sell user data, build marketing profiles, or partner with data brokers.
Zero generative AI training on your files
We will never ingest your documents, codebases, or files into public or proprietary machine learning models or AI training datasets. Your files remain exclusively your property.
Zero-trust customer custody & right to erase
You retain absolute authority over all local telemetry. Quarantined files, detection history, and the local SQLite database can be erased with a single click in the Action Center.
Common Questions
Frequently asked privacy questions.
Detailed answers on endpoint data isolation, virus scanning mechanics, and local custody.
Does SafeLayer AV upload files to cloud servers for virus scanning?
No. SafeLayer AV conducts all static analysis, signature evaluation, and heuristic checks locally on your Windows endpoint. Even when an unknown binary is checked against cloud threat intelligence feeds, only an irreversible cryptographic SHA-256 hash is transmitted—never the file itself.
How does SafeLayer detect threats without reading my personal document contents?
Security scanning focuses on structural file formats, executable code headers, script payloads, macro streams, and behavioral system call patterns. SafeLayer never parses or extracts the human-readable text, images, or confidential contents of your spreadsheets, documents, or personal files.
Can SafeLayer view my passwords, emails, or browsing history?
No. SafeLayer does not install browser extensions to monitor web history, does not perform SSL/TLS decryption (MITM inspection), and does not monitor keystrokes or password fields. Our Internet Protection works at the DNS and socket level strictly to block known Command & Control (C2) botnets and phishing hosts.
Where are quarantined files stored, and can SafeLayer access them?
Quarantined files are moved into a hardened directory on your local machine. They are never mirrored or uploaded to our servers. You can permanently delete or safely restore them whenever you choose.
Enterprise Assurance
Need custom data sovereignty or compliance documentation?
Our engineering and security team is available to assist enterprise compliance teams with Data Processing Agreements (DPA), GDPR data minimization reviews, and local-first deployment verifications.