Code-to-Data
Code-to-Data: use sensitive data without transferring it
Your partner needs to analyze your data? Their code runs on your side, under contract and with your explicit consent. Your files never leave; only the agreed result goes back to them.
Double-walled sandbox
Code runs inside an isolated, doubly limited enclosure: bounds enforced inside the isolate, safeguards on the host side.
Controlled return of results
A result is only returned if it conforms to the exchange contract validated by the data holder.
Complete operation log
Contracts, consents, executions, returns: every operation is recorded and can be tracked and audited.
The Code-to-Data flow, end to end
1. Contract — code, data, and authorized outputs, signed by both parties.
2. Consent — the data holder explicitly validates before any execution.
3. Execution — in a double-walled sandbox, on the holder's side.
4. Return — only the compliant result comes back, with its fingerprint.
Situations you already know
Audit and accounting
Your auditor needs to check your books. Today, that means exporting the accounts and handing them to a third party. With AKARUP, their checks run on your side: they get their report, never your books.
Healthcare and research
A research partner needs statistics from your records. The records never leave the institution; only the aggregates provided for in the contract go out.
Industry and suppliers
Your supplier wants to analyze machine data to optimize maintenance. They submit their algorithm; you keep the production history, they receive their indicators.
Public administrations
One administration must produce statistics from another's data. The code is submitted, validated, and executed on the holder's side; only the results table changes hands.
How it's guaranteed
Where data exchange platforms ultimately rely on transferring files, AKARUP moves the code instead. And these guarantees aren't commitments on paper: they are properties of the architecture.
An explicit security contract
Published contracts, ML-DSA-65 signed manifests, explicit and revocable human consent for every run. Each party knows exactly what is authorized.
Data stays with its holder
No file transfer to the requester or to the server. Code runs in the holder's environment, with only the data the contract designates.
Results with verifiable integrity
Execution is deterministic on our documented execution profile: same code, same data, same fingerprint, with published runtimes and test vectors. Every result ships with its fingerprint, reproducible and comparable.
Three non-negotiable rules
Zero server-side execution
No code ever runs on our servers. Execution happens on the data owner's side, in an isolated sandbox.
Code has no direct access to your files
Code has no direct access to the file system or the Drive: only the data explicitly authorized by the contract is injected by the host. It has no access to the network or the real clock.
Nothing without explicit consent
Every execution on your data requires your explicit, revocable, human approval.
Available today
The Automations screen, in the app
Right now, the published app lets you write code, declaratively reference Drive files, run it in your device's sandbox, and get the result along with its fingerprint. That is the Code-to-Data model, usable today.
Demonstrated and measured
Architecture engineering, measured and documented
The module's two technical risks — safe, deterministic execution of third-party code, and cryptographic interoperability across implementations — are resolved, measured, and documented.
Bit-exact determinism
The same code and the same data produce exactly the same result across four distinct environments, randomness included. The proof is a single SHA-256 fingerprint, identical everywhere.
wazero/Go · macOS · iPadOS · Android NDK → SHA-256 identiques
Double-walled sandbox
Limits enforced inside the isolate and safeguards on the host side. All three failure scenarios — memory exhaustion, infinite loop, wall-clock timeout — are cleanly interrupted, on every platform.
quickjs-ng · 64 Mio · budget de calcul · horloge figée · aléa semé
Two implementations, one protocol
The cryptographic stack exists in TypeScript (the app) and Go (the CLI), interoperable bit-for-bit in both directions.
TypeScript ↔ Go · interopérabilité au bit près
Cross-implementation recovery
An account created on mobile can be recovered from the CLI with a mnemonic phrase, and vice versa — validated under real conditions.
BIP39 · récupération cross-implémentation validée
CLI
The AKARUP CLI
The CLI is the protocol's reference client implementation, written in Go. It carries the full Drive stack and proves the protocol is specified, testable, and reproducible outside the app.
- →Complete encrypted Drive stack, interoperable with the mobile app in both directions, bit-for-bit.
- →Account recovery and new-device enrollment via mnemonic phrase.
- →Built for integration, automation, and organizational server-side use.
A Code-to-Data use case?
Cross-organization exchanges, regulated professions, sensitive data processing: let's talk about your context.
ML-KEM-768 · ML-DSA-65 · XChaCha20-Poly1305 · Argon2id