Compliance & Regulatory Standards

Sino complies by architecture: files are encrypted client-side via AES-256-GCM before transmission. Sino operates zero backend servers holding user data, tracks zero telemetry, and provides a 2-pass forensic overwrite panic sequence that guarantees instant, irreversible local data destruction.

Sino enforces Total Cloud Blindness: all cloud paths and folder hierarchies are blinded with salted HMAC-SHA256 hashes (CloudPathHasher). When users sync to multi-cloud targets abroad, zero plaintext personal data or identifiable structures ever cross geographic borders.

Sino operates as a premium, subscription-free paid software tool. Sino sells zero customer data, shares zero data with third-party brokers, and embeds zero advertising networks. Users maintain 100% cryptographic sovereignty over their files and encryption keys.

Because Sino is local-first, users never delegate custody of personal documents to Sino servers. Media keys are derived directly on-device using RFC 9106 Argon2id, and open-source CLI recovery tools ensure permanent access independence.

Sino actively mitigates "Harvest Now, Decrypt Later" (HNDL) attacks by establishing per-device shared secrets using ML-KEM-768 and authenticating manifest headers with ML-DSA-65, while retaining AES-256-GCM for 128-bit quantum payload resistance against Grover's algorithm.

Root Master Keys and local ML-KEM private keys are sealed inside physical hardware security chips. Keys are flagged non-exportable, meaning operating system malware or root exploits cannot extract private key material from device silicon.

Under the HIPAA Conduit Exception Rule, third-party cloud hosts (Google Drive, MEGA, S3) act strictly as blind digital conduits because files and filenames are encrypted client-side before upload. Users can safely archive medical records without exposing PHI to cloud providers.

Sino enforces strict memory hygiene: all transient key arrays and plaintext buffers are wrapped in try-finally blocks and immediately wiped via platform.fillZero(). Screenshots are blocked at the OS window manager level.

In multi-tenant cloud storage, physical overwriting of remote hard drives is impossible. Sino satisfies NIST SP 800-88 Cryptographic Erase (CE) by destroying local key material. Without the key, cloud ciphertext across all historical snapshots becomes permanently unrecoverable in under 50 milliseconds.

Sino implements strict cryptographic separation: root keys derive intermediate epoch keys, which derive single-purpose per-file AES-256-GCM keys. Cloud storage path hashes utilize distinct salts (CloudPathHasher), ensuring zero key material is ever shared across functions.

Enterprise security officers deploying Sino eliminate the application vendor from their ISMS compliance audit boundary. Because Sino operates zero remote servers and stores zero keys, third-party insider risks, vendor credential compromise, and multi-tenant breach vectors are architecturally impossible.

Sino complies with emerging European cybersecurity mandates by decoupling client execution from centralized server infrastructure and publishing its cryptographic streaming algorithms openly. Independent researchers and auditors can verify mathematical integrity directly on GitHub.

Sino simplifies enterprise SOC 2 audits: because Sino is local-first software and operates zero multi-tenant servers storing customer data, deploying Sino does not expand your organization's third-party vendor audit boundary. Users can safely leverage SOC 2-certified cloud storage providers without exposing plaintext data to them.

Sino implements the core technical controls mandated by NIST CSF 2.0. By enforcing zero-escrow client-side encryption and hardware-bound root derivation, Sino satisfies stringent Protect (PR) and Govern (GV) subcategories across distributed multi-cloud endpoints without centralized exposure.

Sino aligns with CIS Controls v8.1 defensive recommendations: local databases are sealed in SQLCipher with StrongBox/TPM key wrapping, unencrypted disk paging is blocked via volatile RAM streaming, and automated background sync provides redundant disaster recovery capabilities across heterogeneous clouds.

Under technical guidance from the UK Information Commissioner's Office (ICO), storing data in the cloud where the host has zero access to decryption keys eliminates unauthorized processing liability. Sino ensures complete compliance for UK citizens and organizations managing confidential records.

For public sector agencies and defense contractors operating under FedRAMP mandates, Sino provides sovereign endpoint cryptographic controls before data enters multi-cloud storage. Files are shielded with FIPS-anchored keys, fulfilling NIST SP 800-53 high-impact baselines without relying on cloud vendor security promises.

Users and organizations archiving tax documents, bank statements, invoices, or payment receipts satisfy PCI-DSS v4.0 storage requirements by design. Because all payloads are encrypted locally with AES-256-GCM before transmission, financial records and account identifiers are never stored or transmitted in plaintext.

Legal defense attorneys, forensic investigators, and law enforcement professionals handling sensitive case files and CJI can safely backup to commercial cloud storage. Under Sino's Total Cloud Blindness, cloud providers never possess the keys needed to inspect case records, directly satisfying strict FBI CJIS access and confidentiality mandates.

Sino provides mathematical immunity under the NDPA: client-side AES-256-GCM and post-quantum ML-KEM-768 encryption render cloud intermediaries blind conduits. Salted HMAC path blinding (CloudPathHasher) guarantees that no identifiable personal data crosses geographic boundaries during multi-cloud sync, and the offline Panic Protocol enables instant cryptographic erasure under Section 34.