Technology
Zero-Outbound, By Hardware
Hardware-based private-network security without an outbound internet connection. ICTK PUF chips and air-gap architecture keep data under your control.
Connection via a private network (Private Wi-Fi)
- Desktop app
- Mobile app
- PUF USB key
Access is through the dedicated app only. Browser access is blocked and the vault has no internet connection.
Supported platforms: Windows · macOS · Linux · iOS · Android
Key security specifications
- Security chip
- ICTK PUF (unclonable semiconductor fingerprint)
- Encryption
- AES-256 and RSA-2048 dual encryption
- Device communication
- Mutual TLS authentication
- Integrity
- SHA-256 and TSA timestamping
- Local AI
- NPU 6 TOPS · Local RAG LLM
- Vault unit
- Embedded Linux OS · 8-inch touchscreen
Architecture
System architecture
The app connects to the vault through a private network without using the internet.
Client App
Dedicated desktop and mobile apps
- D-GO Vault Management
- Data Encryption & Decryption
- Document Timestamping
- Proof of Document Viewing
- Audio Recording & Storage
- Key & Certificate Management
- Automatic data erasure after transfer
Private network (Private Wi-Fi)· Air-Gap · Zero-Outbound
Embedded Server (Vault unit)
Linux-based embedded OS
PUF Core Logic (Encryption and control)
Zero-Outbound blocks external internet connections; input and output remain on the private network.
Dual recovery using the USB hardware key and hardware information
Redundant storage
- · RAID 1 mirroring
- · C/D/E security partitions
Environmental control
- · Built-in UPS
- · Shutdown at 125°F or above
Physical door mechanism
- · Integrated PUF authentication
- · Motor driver control
Secure Port
- · Enabled after PUF authentication
- · USB-C port access control
Local AINPU 6 TOPS
Private-network Local RAG LLM for document search and summarisation
Network isolation and hardware encryption work together to protect the server.
Core Technology
Four core technologies
Four technologies underpinning D-GO Quantum Data Vault
- PILLAR 1
PUF-based cryptographic control
Core Logic
- Generate encryption keys using a unique semiconductor fingerprint
- Manage keys in volatile memory to prevent copying
- Zero-Outbound encryption with external internet access blocked
- Complete encryption operations within the device
- PILLAR 2
Physical and digital recovery
Dual Recovery
- Recover with the hardware key if digital credentials are lost
- Combine the PUF key with hardware information
- Integrate electronic buttons and motor control
- Multiple recovery paths
- PILLAR 3
Environmental sensing and data protection
Environmental Protection
- Automatic shutdown above 125°F (52°C)
- Real-time RAID 1 mirroring
- UPS uninterruptible power supply
- Impact and vibration detection and alerts
- PILLAR 4
Hybrid 2FA and Secure Port
Access Control
- Keypad and PUF hardware key authentication
- Enable USB-C ports only after PUF authentication
- Dynamic network drive control
- Log all access attempts
Defense in Depth
Security layers
Eight layers of protection, from physical isolation to audit trails.
- Layer 0
Physical isolation
Private network only, with no internet connection path
- Layer 1
Device authentication
PUF and mutual TLS authentication restrict access to registered devices
- Layer 2
Proximity requirement
Automatically lock files outside the permitted proximity range
- Layer 3
User authentication
Tier-based authentication: ID and password, two-factor authentication and biometrics
- Layer 4
Data encryption
AES-256 dual encryption
- Layer 5
Integrity verification
SHA-256 and TSA timestamping
- Layer 6
Malware scanning
Real-time scanning of incoming files
- Layer 7
Audit trail
Log chains for access and export events
Partitions
Security tier partition management
Classify and protect files in C, D and E partitions according to sensitivity. More sensitive documents require stronger authentication.
CTier General
- Authentication
- ID and password
- Document scope
- Everyday business documents
- ID and password
DTier Protected
- Authentication
- + Two-factor authentication
- Document scope
- Contracts, HR and finance
- ID and password
- Two-factor authentication
ETier Confidential
- Authentication
- + Smartphone biometrics
- Document scope
- Critical confidential data and intellectual property
- ID and password
- Two-factor authentication
- Smartphone biometrics
Automatic classification
Automatically assign files to C, D or E partitions based on user tags and security tier.
Roadmap
Research and development roadmap
Plans to expand the platform by combining AI features and physical security technologies.
7.1
Storage security
- Research into NVMe SSD data erasure when the board is removed
7.2
Local AI expansion
- Local NotebookLM features
- Wiki-style information system
Local LLM document search and summarisation are already included
7.3
Hardware expansion
- Research into camera-based seal systems
7.4
Communication and tracking
- Independent communication board (Wi-Fi, BLDC and GPS)
- Heartbeat transmission when power is disconnected
- Notifications to designated clients
- Location tracking under consideration
Comparison
Key differences
Data location
- Conventional products
- Copies stored in the cloud
- D-GO
- Air-Gap and Zero-Outbound; stored only on the device
Device connection
- Conventional products
- Broadly accessible
- D-GO
- Connections restricted to PUF-authenticated devices
If lost
- Conventional products
- Risk of data exposure
- D-GO
- Automatic security key erasure protects data
Asset management
- Conventional products
- Digital assets only
- D-GO
- Unified physical and digital asset management
Document evidence
- Conventional products
- No authenticity verification
- D-GO
- TSA timestamps provide evidence of existence
Access control
- Conventional products
- Continuously accessible
- D-GO
- Protection through proximity checks and device authentication
AI use
- Conventional products
- Documents sent to external AI services
- D-GO
- Private-network Local RAG LLM searches and summarises documents within the vault
| Comparison criteria | Conventional products | D-GO Quantum Data Vault |
|---|---|---|
| Data location | Copies stored in the cloud | Air-Gap and Zero-Outbound; stored only on the device |
| Device connection | Broadly accessible | Connections restricted to PUF-authenticated devices |
| If lost | Risk of data exposure | Automatic security key erasure protects data |
| Asset management | Digital assets only | Unified physical and digital asset management |
| Document evidence | No authenticity verification | TSA timestamps provide evidence of existence |
| Access control | Continuously accessible | Protection through proximity checks and device authentication |
| AI use | Documents sent to external AI services | Private-network Local RAG LLM searches and summarises documents within the vault |
Q & A
Technical FAQs
- What does Zero-Outbound mean?
- A security model with no outbound internet data path. D-GO operates on private Wi-Fi and handles encryption and decryption within the vault. Keys are generated by the PUF chip and held in volatile memory.
- What happens if I lose the PUF hardware key?
- The recovery system combines digital credentials and a hardware key. If the hardware key is lost, the registered mobile app and hardware information are used to regenerate the PUF key.
- Does D-GO currently use quantum encryption?
- D-GO Quantum Data Vault is designed with the quantum era in mind. It currently uses AES-256 and RSA-2048, with post-quantum cryptography (PQC) planned for the future.
Security built into the architecture.
See it on a physical device. Request a demonstration.
See PUF authentication and private-network AI search and summarisation on a physical device. Contact us for corporate deployment enquiries.