Zero-Server Security & Compliance Architecture

1. The Zero-Server Storage Paradigm

Unlike legacy session recording tools that capture DOM mutations, user keystrokes, and network payloads and upload them to multi-tenant cloud databases, ReMOAT operates under a strict Zero-Server Invariant.

All telemetry (console messages, network headers, DOM trees, and REPL evaluation commands) streams exclusively peer-to-peer over encrypted WebRTC DataChannels directly between the customer browser and the developer workstation. ReMOAT servers never record, persist, or ingest session telemetry onto any disk or database.

2. Cryptographic Security & DTLS 1.3 Handshake

All WebRTC peer connections are negotiated using Datagram Transport Layer Security (DTLS 1.3) and Secure Real-time Transport Protocol (SRTP). Traffic cannot be inspected or tampered with by intermediary reverse proxies, NAT routers, or ISPs.

• End-to-End Encryption: Session keys are generated ephemerally inside client browser memory and discarded immediately upon session termination.
• Automatic Input Sanitization: Fields with autocomplete="cc-number", type="password", or data-remoat-mask are masked client-side before serialization.

3. Global Privacy Compliance Matrix