Hidden Tokens / IT and security

Hidden Tokens: IT and security sheet

For the IT department of an audit firm, a law firm or a group that has to approve Hidden Tokens on managed workstations. Every statement below comes from the product's own code and configuration: network flows host by host, where data lives, how the installers are built and signed, what the organisation's signed policy enforces, and what is not done yet.

Updated 8 November 2026 · desktop app 0.40.1, connector 2.101.0, sentinel 0.27.1, browser extension 0.12.0

What it is, what it is not

Hidden Tokens is a local pseudonymisation layer between the files on a workstation and AI tools. Names, companies, identifiers and amounts in Word, Excel, PDF, PowerPoint and text files are replaced by stable codes (NAME-001, COMPANY-003) on the workstation before any AI reads anything; answers are translated back on the workstation. The mapping key never leaves the organisation.

What it does not do. Hidden Tokens sends no data to any AI or to the vendor. The user sends the coded text or copy, in their usual AI tool, through that tool's own channel. The vendor runs no application server. The product performs reversible pseudonymisation with human review; it supports compliance, it does not certify it.

Network flows

Zero requests by default

• The connector makes no network request. The proof runs in continuous integration on Node 26: the connector runs under Node's permission model without --allow-net, so any connection would fail, and the whole workflow (spreadsheet, PDF, OCR, log, dashboard) must still work. The licence is an Ed25519-signed token checked with an embedded public key: no online activation, no usage counter, no machine identifier.
• The sentinel (resident process) has no dependency and makes no request. Its dashboard listens on 127.0.0.1 only, protected by a 32-byte token; the page's fonts are embedded, so not even a local request is made.
• The browser extension asks only for storage, scripting and the host http://127.0.0.1/*. Nothing leaves the workstation other than towards 127.0.0.1.
• The admin console makes no request. Console and workstations exchange through your own file share, never through a vendor server.

The only outgoing connections, all in the desktop app, all on explicit choice

No other request is made by the app, the sentinel, the connector or the extension. Help links (hiddentokens.com, claude.ai/download, the Chrome Web Store listing) open in the system browser, never inside the app.

Two cases that talk to a third-party service

• The Excel add-in =HT.CLAUDE(): the text coded by the sentinel goes to the Anthropic API from Excel, with the user's own API key, after explicit consent in the task pane. The add-in is loaded from hiddentokens.com/excel/. Fail closed: sentinel absent, consent not given or key missing, nothing leaves. The sentinel and the connector still make no request.
• The connector firewall: a third-party MCP connector (Gmail, Drive, a CRM) that the user declares in Hidden-Tokens/pare-feu.json is started by Hidden Tokens on the workstation, and it talks to its service; Hidden Tokens codes its answers before they reach Claude and translates a code back to that connector only if the value came from it.

The website itself is static (Netlify); its contact form, the Polar checkout and the activation page are described in the privacy policy. None of them is called by the installed software.

Data at rest

In each working folder: the Hidden-Tokens/ subfolder

The working folder must not be synced (iCloud, OneDrive, Google Drive, Dropbox): the key would travel with it. The confinement audit flags this, as well as any other Claude Desktop extension or MCP server that could see the folder.

On the workstation, outside working folders

On the organisation's file share (Firm and Organisation plans)

The policy (politique.nanomizer.json + .sig: rules, names as HMAC fingerprints, Ed25519 signature), the organisation registry (registre/registre.json signed by the console, one AES-256-GCM encrypted line per entry, one append-only file per workstation), and the proofs (ledger entries, coverage counts, one file per workstation). The share does not need to be trusted: what is put there is encrypted or signed. The administrator's own workstation keeps the firm's private key encrypted (scrypt + AES-256-GCM) and the policy source with names in clear, which never leaves it.

Never written: a real value in the log, the ledger, the coverage report or the events; a file, key or log at the vendor's; usage data or a machine identifier in the licence.

Managed installation

macOS

• Package: HiddenTokens-<version>-arm64.dmg (install) and .zip (update). Apple Silicon only, macOS 13 or later; no Intel Macs.
• Signature: Developer ID Application, team identifier 2CTJY8T842, hardened runtime, notarised by Apple. Bundle identifier com.ai4x.hiddentokens. Entitlements: allow-jit, allow-unsigned-executable-memory, disable-library-validation (the minimum for Electron) and automation.apple-events (the keyboard shortcut sends copy and paste to Claude Desktop). No outgoing-network entitlement.
• What the app registers: a hidden-tokens:// URL scheme (the app always confirms in a native dialog before watching a folder, and refuses the disk, the home folder and its own folder); an Automator quick action in ~/Library/Services; open at login only at the user's request. The command-line sentinel can install a per-session launchd agent without sudo.
• Processes: one connector per watched folder, started with the app's own Electron binary in Node mode (ELECTRON_RUN_AS_NODE); security is called for the keychain. macOS asks for access to Documents or the Desktop at first use.

Windows

• Package: HiddenTokens-<version>-x64.exe, NSIS installer produced by electron-builder on GitHub Actions. Windows 10 and 11, 64-bit.
• Per user, no administrator rights: oneClick: true, perMachine: false. Installs into the user's profile; no service, no HKLM key. The installer writes HKCU\Software\Classes\Directory\shell\HiddenTokens and Directory\Background\shell\HiddenTokens (right-click "Protect with Hidden Tokens", command --watch "<folder>", confirmed by the app) and removes both on uninstall. On Windows 11 the entry sits under "Show more options": the first-level menu would need a signed MSIX, which does not exist.
• Silent install: standard NSIS switches, HiddenTokens-<version>-x64.exe /S and /D=<folder> (always last). This is NSIS's standard behaviour for electron-builder installers; the product has no test specific to silent installation.
• Not code-signed yet: SmartScreen shows "unknown publisher" on first run (More info → Run anyway). For a managed fleet, allow the installer by hash or by an AppLocker / WDAC path rule on the user-profile install folder. Signing (OV certificate or Azure Trusted Signing) is planned, without a date.
• Workstation key: protected by DPAPI (user scope) in %APPDATA%\Hidden Tokens\trousseau\; powershell.exe is called for DPAPI. Updates follow the same rules as on macOS (latest.yml).

The connector in Claude Desktop

• The .mcpb is a zip archive produced by @anthropic-ai/mcpb pack (manifest.json, server/, pinned dependencies), attached to every release; /download/connector points to the latest one.
• macOS: the app hands the file to Claude Desktop, which asks for confirmation and installs it itself; the app never writes into Claude's folders. Windows: the app copies it to Downloads; in Claude Desktop, Settings → Extensions → Advanced settings → Install extension.
• Settings exposed to the user: working folder (required), team key folder, firm enrolment file, workstation name for the report, go through the app when it runs, "Verified by Hidden Tokens" line, licence key (sensitive field).

The browser extension

• Chrome, Edge, Brave, Arc (Manifest V3) from the Chrome Web Store; Firefox and Safari to come.
• Policy deployment: force-install with ExtensionInstallForcelist (Google Admin, GPO, MDM) and lock settings through the extension policy: sansSentinelle (retenir: nothing leaves without protection, the user cannot change it), saisie (protegee: a field the site cannot read), port (47117 by default). Example: { "sansSentinelle": { "Value": "retenir" } }. Details on the extension page and its privacy policy.
• Without a policy, the extension lets messages through and says so until it has been paired once; from the first pairing on, it is fail closed. Private windows disable extensions by default; the organisation can disable them (IncognitoModeAvailability).

Claude Code plugin and Excel add-in

The Claude Code plugin (public repository, FSL-1.1-ALv2 licence) installs a PreToolUse hook: in a folder that contains Hidden-Tokens/, reading, searching or editing a document, the key or a decoded file is refused; the coded copies remain allowed. The Excel add-in is sideloaded, pending the Office store.

Governance and proof

The organisation's signed policy

The admin console creates the firm (Ed25519 key pair, private key encrypted with a passphrase), enrols each workstation with a file handed over in person, and signs the policy placed on the share: names always coded (as HMAC fingerprints, never in clear), custom patterns, terms left readable, forbidden items per detector, enabled industry packs. A local page lets the administrator write, dry-run and sign the policy; it imports the output of the AI charter generator.

On each workstation, the connector pins the firm's public key at first use and re-reads and re-verifies the policy at every coding call: absent, tampered, downgraded or expired (72-hour grace), coding stops; share unreachable, the verified local copy is used with a warning after 24 hours. Any unexpected error counts as tampered (fail closed). Decoding is never blocked.

The organisation registry

One code key for the whole organisation: the same person gets the same code on every workstation. The registry lives on your share, signed by the console and encrypted line by line; each workstation's private key is in its keychain. Escrow with a quorum of guardians and a printable recovery sheet. An invalid registry signature stops coding and leaves decoding. Key rotation is not available yet.

The proofs

Compliance: what the product says, and does not say

• Reversible pseudonymisation, human review of the plan, a log of what the AI received. For the organisation, which holds the key, pseudonymised data remains personal data (GDPR, art. 4(5)).
• Hidden Tokens supports compliance; it does not certify it. The impact assessment, the choice and contract of the AI provider, informing the persons and checking the output remain the organisation's.
• Sheets by jurisdiction: France, the UK GDPR, Morocco's Law 09-08, and the CNB compliance file.
• The vendor claims no certification (neither SOC 2 nor ISO 27001) and does not speak of "end-to-end encryption": the local folder key is protected by file-system permissions; the registry and the secrets vault are encrypted.

What IT can verify on its own

# Installer fingerprints (compare between two workstations, or with the release)
shasum -a 256 HiddenTokens-<version>-arm64.dmg              # macOS
certutil -hashfile HiddenTokens-<version>-x64.exe SHA256     # Windows
# latest-mac.yml / latest.yml on the release carry the SHA-512 of each file

# Signature and notarisation on a Mac
codesign -dv --verbose=2 "/Applications/Hidden Tokens.app"   # TeamIdentifier=2CTJY8T842
spctl -a -vv "/Applications/Hidden Tokens.app"               # source=Notarized Developer ID

# The connector is a readable archive
unzip -l hidden-tokens-connector-<version>.mcpb              # manifest.json, server/, node_modules/

• Zero network: on a test workstation, turn the network off; coding, decoding and producing the log work identically.
• Confinement audit: ask Claude to check confinement on a pilot workstation; other open doors (extensions, MCP servers, synced folder) are listed in clear, paths included.
• Acceptance and benchmark: the customer acceptance script is replayed on Mac and Windows before each release, and an automated run with the real sentinel, connector and browser extension runs in CI on fictional documents. Detection results and the leak test are published with their raw data on the benchmark page.
• Source code: private repository today; the Claude Code plugin is public (FSL-1.1-ALv2). Opening a core is in preparation, without a date.

Known points and roadmap

Contact and Organisation plan

Write to info@hiddentokens.com. The Organisation plan (21 to 100 seats: €190 per seat per year excl. VAT; 101 to 500: €140; above 500 on quote; €4,900 minimum per year) adds escrow and recovery sheet, the admin console, rules and packs deployed by the policy, an IT report, priority support with a first answer within 4 business hours, half a day of deployment, an annual attestation, a dedicated contact and a framework agreement (in French). Term: 12 months by purchase order, no tacit renewal, no payment method kept. A 30-day pilot on 5 to 20 seats (€1,900 excl. VAT, fully deducted if the order follows) comes with success criteria signed at the start. Trial: 14 days, no account; when a licence expires, coding stops and decoding never does.