Controls you configure. Not a certification.
Copywarden ships three data-handling profiles, named after the regimes they were designed around. They are configurable controls, and Copywarden does not represent them as an attestation by anyone. Below is what each changes — and what none of them covers.
Three profiles, and exactly what each one caps.
GDPR profile
Caps clipboard content at 7 days, against a 90-day standard default.
HIPAA profile
Caps at 7 days, and switches off category labelling.
Banking profile
Caps at 3 days — the shortest of the three — and switches off category labelling.
Strictest setting wins
Turn on more than one and the shortest cap applies. The cap holds even with auto-delete switched off, so a profile cannot be defeated by a setting elsewhere.
Category labels stop being written.
Copywarden normally sorts clips into categories using on-device inference. Under HIPAA and Banking that stops entirely: no new labels, stored labels stripped, a label from another of your devices refused. Clip content is encrypted with AES-256-GCM, but a confirmed category name persists as ordinary preference data outside that store — and a plaintext label reading “Medical” is itself a disclosure.
Sync off, agents off, and automatic logoff.
With sync off, clipboard history is not sent to any cloud service. Turn off Shortcuts and AI agents and every automation request is refused. Automatic logoff closes the other gap: in HIPAA and Banking modes, after a period of inactivity the next reveal asks for Touch ID or your login password again.
The limit, plainly: these switches are enforced by the app itself. They are not an operating-system network boundary.
The trail, and getting it out.
Security-relevant events append to an HMAC-chained log, so an entry cannot be removed or rewritten without breaking the chain — tamper-evident: interference is detectable, not impossible. It records what happened and to how many items, never clip content. Export produces JSON, CSV, or a review report scoped to a chosen framework; it is itself authorized, its refusals are logged, and MDM policy can require user presence or forbid it. Export is Enterprise-tier — in the app today, priced by conversation, because per-seat billing is not built yet.
Tell us what your reviewer actually asks for.
There has been no independent security review of Copywarden, and no bug-bounty programme — you should hear that here rather than find it in a questionnaire. If you know which controls you have to evidence, that is a more useful conversation than a feature list.
Talk to usRead the threat model