No Record online architecture

Abstract

No Record is a Cloudflare-hosted AI workspace designed to avoid server-side application retention of request content while preserving usable browser-local history, optional client-encrypted sync, current model choice, bounded orchestration, and operational metering.

Architecture

browser IndexedDB / volatile maps / AES key
          ↓ HTTPS
Cloudflare Worker validation + routing + quotas
          ↓
current Workers AI model route
          ↓
response returned; aggregate usage recorded

Capability contracts

Live: Chat, Auto routing, Council, Loom, Images, browser-local Motion, local JavaScript Code, MCP, API keys, Usage, and encrypted Sync. Preview: zero-balance Credits. Unconfigured: Payments. Capacity-blocked: Browser Run. Authorization-blocked: Cloud Containers.

Privacy pipeline

Smart Privacy runs before browser requests and uses five regex categories. A random placeholder namespace prevents stable cross-request tags. A volatile map restores placeholders in the current response and is cleared on commit/dispose. The receipt records SHA-256 input digest, replacement count, categories, and rawStored: false.

Auto routing

Balanced routing chooses the current code route for code intent, a reasoning route for analytical intent, a long-context route for large input, a fast route for short input, and GPT OSS 120B as fallback. Fast, Deep, and Economy strategies are explicit. User-selected model IDs bypass Auto.

Adaptive Loom

Lean performs one drafter call. Balanced performs one call unless deterministic risk signals require a critic/editor. Strict performs draft, critique, and finalization. Fixed adds a router pass. Every model ID is validated against TEXT_MODELS before execution.

Media and code

Images return provider JPEG bytes and stay in a browser gallery. Video returns an image keyframe and local render instructions. Code source stays local; JavaScript runs in an opaque-origin frame. No provider video/audio or cloud container is implied.

Security properties

API and recovery verifiers use a server pepper plus per-credential salt under HMAC-SHA256. Sync uses 256-bit AES-GCM with schema AAD and optimistic versions. URL policy blocks credentials, private networks, and unsupported protocols for remote browser/connector targets.

Quotas and metering

Short windows: 90 general requests and 20 AI requests per 60 seconds per actor/route. Daily anonymous modality quotas are 24 text, 3 image, 1 video, 6 browser, 12 code, and 20 connector. API keys have separate daily ceilings while still consuming the anonymized IP quota.

Limitations

No Record does not prove anonymity, provider deletion, model forgetting, absence of side channels, or compliance. Traffic metadata remains observable. Client-side storage is subject to browser-origin compromise. Unavailable capabilities remain labeled preview, unconfigured, capacity-blocked, or authorization-blocked.