Nine links. A third party, DPO, judge or counsel, verifies them without LexLabs, without a network, ten years from now. And we publish what the proof does not prove yet.
What is produced, what it proves, and how someone other than us verifies it.
| Link | What is produced | What it proves | How a third party verifies it |
|---|---|---|---|
| 1 · Zero network, attestedby the operating system | A permanent "Network: 0 connections" witness, an OS reading (lsof on macOS, Get-NetTCPConnection on Windows), a kill-switch: any non-local request is cancelled, the engine refuses any outbound connection and records every refusal in the sealed log. | That nothing leaves the machine while in use. | Copy the exact command shown by the witness and run it; variants: Wi-Fi off, firewall set to "deny all". |
| 2 · Sealsmapping vault | Table encrypted with Argon2id + XChaCha20-Poly1305, one dedicated password per table, optional FIDO2 hardware second factor (two layers, two keys). | The separation of additional information required by the EDPB; a stolen password alone opens nothing. | Second-factor descriptors under authenticated data: any removal or downgrade is detectable. |
| 3 · Signed auditEd25519 | One .audit.json file per export: operator identity, version, entities, k-anonymity, nature of the output ("pseudonymised"), pseudonym warning. | Attribution: who did what, with which version, with no possible alteration. | Standalone verifier; key fingerprint confirmed out of band, as with PGP or SSH. |
| 4 · Sealed logSHA-256 chained | Canonical JSONL, chained hashes, strictly increasing numbering, signed per operator, UTC timestamps, anchored cycle so that a reset is detectable. | The order and integrity of every sensitive action; a compliance score cannot be forged after the fact. | Chain check in one command; any gap or reordering is visible. |
| 5 · Co-signaturefour-eyes principle | A second operator adds a signature to an existing audit; the original is never rewritten. | Double validation in a firm or a medical unit; the theft of a single key is not enough. | The verifier shows one panel per signatory; one invalid signature invalidates the whole. |
| 6 · Qualified timestampeIDAS art. 42 | RFC 3161 request on the log anchor, token from a qualified provider, out-of-band mode by default, opt-in connected mode limited to one host and logged. | The legal presumption of date accuracy: the log existed in this state at time T. | Token fingerprint and anchor presence checked by the verifier; CMS signature verifiable with the provider's tools. |
| 7 · Third-party verifieroffline | A single HTML file shipped with every export; no request, no dependency on lexlabs.fr, nothing persisted. | Valid signature, received document conformant, signatory identity, operation details, timestamp. | Double-click, drop the audit and the final document, in any browser, "ten years from now even if LexLabs no longer exists". |
| 8 · Measured risknot declared | k computed against the real INSEE population (signed table), case-file-wide quasi-identifier register, retroactive generalisation, count of art. 9 attributes. | The EDPB's singling-out criterion, with honesty about what k does not cover. | k values and composition scope in the signed audit; explicit "pseudonymised" warning. |
| 9 · AI crossing logcheckpoint sessions | Documents handed over under neutral names, exchanges recorded, deliverables restored under supervision; two levels: observed by the checkpoint / declared by the AI; signed PDF export. | What actually crossed the line, in which direction, when. | Sealed log + audit; a "Declared by the AI" badge on what the checkpoint could not observe. |
Zero network is not a promise: it is a fact you establish yourself, in the meeting room, in three variants.
The "Network: 0 connections" witness shows the exact system command it runs. Copy it, run it in a terminal, compare.
lsof -i -a -p <pid> · Get-NetTCPConnection -OwningProcess <pid>
Why local, the witness in detail (in French) →Cut the network, open the case file, pseudonymise, export, verify the audit. Everything works: nothing depends on a server.
AI: user guide (in French) →Block every outbound connection from the application: no alert, no degradation. Any attempted refusal by the engine would be recorded in the sealed log.
Protocol page with network capture and installer fingerprints: comingThe verifier ships with every export. It fits in one file and needs nothing else.
Double-click lexlabs-verifier.html. It opens in any browser, with no connection.
The .audit.json file and the final document received. Nothing leaves your browser.
Signature valid or not, document conformant or not, signatories, operation, timestamp, measured k.
Online verifier (download for airplane mode from the page) · sample audit and DPO guide: comingThe JUNAO engine is benchmarked every night across six countries by our automated benches. Here is the coverage index by language and by tier.
| Language · regime | General-purpose tier | Quasi-identifiers tier | Health tier |
|---|---|---|---|
| French | 0.954 | 0.955 | 0.936 |
| German | 0.984 | 0.990 | 0.990 |
| Italian | 0.983 | 0.990 | 0.990 |
| Spanish | 0.977 | 0.983 | 0.983 |
| English · United States | 0.965 | 0.960 | 0.960 |
| English · United Kingdom | 0.961 | 0.932 | 0.932 |
A proof is only as credible as its published limits. Here they are, before a prospect discovers them.
The same pseudonyms across every document of a case file, professional roles, k measured at case-file level: Mode 3.
The patents (in French) →Pseudonymise a snippet in one second with a control flash, with nothing leaving the machine: PseudoExpress.
The patents (in French) →Readable log, sealed log, AI crossing log: what is recorded, and how to read it.
Logs (in French) →A continuous, signed EDPB score that cannot be forged after the fact.
Compliance score (in French) →The re-identification risk measured against the real population, at case-file level.
k-anonymity (in French) →Access by approval, reply within 48 working hours.
Request access