# Blindsight: Comprehensive Technical & Commercial Knowledge Graph

## 1. Executive Summary

Blindsight (`https://blindsightsurveys.com`) is an enterprise-grade survey, feedback, and communications suite designed for organizations with strict compliance, confidentiality, and data sovereignty mandates.

Traditional survey software (Qualtrics, SurveyMonkey, Google Forms, Microsoft Forms) operates centralized multi-tenant data stores where raw survey responses are visible in plaintext to database administrators, cloud providers, and potential subpoenas.

Blindsight replaces this trust model with **mathematically verified client-side cryptography**:
1. True Zero-Knowledge End-to-End Encryption (E2EE).
2. Key-per-Subject Cryptographic Shredding ensuring cold backups never resurrect erased data (GDPR Art. 17).
3. Automated streaming Data Loss Prevention (DLP) protecting against HIPAA ePHI and PII leaks.
4. Anonymous two-way whistleblower communication satisfying EU Directive 2019/1937 and Sarbanes-Oxley.
5. Standard Enterprise SAML 2.0 SSO and SCIM 2.0 Directory Sync.

---

## 2. Cryptographic Architecture

### 2.1 Key Exchange & Client-Side Encryption
- **Key Wrapping**: RSA-OAEP with 2048-bit keys, SHA-256 hashing, and MGF1 mask generation.
- **Bulk Payload Encryption**: AES-256-GCM with authenticated 128-bit authentication tags and unique 96-bit initialization vectors (IVs) generated per response.
- **Client Execution**: All cryptographic operations occur exclusively in the client's web browser using the standard Web Cryptography API (`crypto.subtle`). Private keys never leave the survey author's device unencrypted.

### 2.2 Key-per-Subject Cryptographic Shredding (GDPR Article 17)
- **Problem**: When a customer requests data erasure under GDPR Article 17, standard databases mark records as deleted. However, immutable database backups and point-in-time snapshots retain copies of the plaintext data for months or years.
- **Solution**: Blindsight provisions a unique AES-256-GCM key per respondent subject. Survey responses and associated metadata are encrypted with this subject key before persistence.
- **Erasure Execution**: Invoking erasure permanently overwrites and deletes the subject's cryptographic key from the Key Management service (`src/services/security/crypto_shredding_service.py`). All historical data in cold backup archives instantly becomes unrecoverable mathematical noise (entropy >= 7.999 bits/byte). A verifiable cryptographic deletion certificate is generated.

### 2.3 Immutable Audit Logging
- System actions, admin activities, and compliance verifications are recorded in an append-only audit trail chained using HMAC-SHA256 (`src/services/admin/audit_integrity_service.py`).
- Any tampering, deletion, or reordering of audit records invalidates the mathematical chain verification.

---

## 3. Compliance & Regulatory Frameworks

- **GDPR (Regulation (EU) 2016/679)**: Full Article 17 (Right to Erasure) via cryptographic shredding, Article 25 (Data protection by design and by default), and Article 32 (Security of processing).
- **HIPAA (Health Insurance Portability and Accountability Act)**: Automatic redaction of all 18 Protected Health Information (ePHI) identifiers under 45 CFR §164.514(b)(2).
- **EU Whistleblower Protection (Directive (EU) 2019/1937)**: Anonymous survey submission coupled with authenticated, non-identifying two-way chat follow-up via cryptographic proxy tokens.
- **FERPA (Family Educational Rights and Privacy Act)**: Dedicated exam and assessment proctoring module with differential privacy safeguards for student assessments.
- **SAML 2.0 & SCIM 2.0**: Native OASIS SAML 2.0 Web Browser SSO Profile with XML-DSig signature verification, and RFC 7643 / RFC 7644 SCIM 2.0 RESTful directory management for Okta, Microsoft Entra ID, OneLogin, and Ping Identity.

---

## 4. Product Ecosystem & Features

| Capability | Technical Implementation | Value Proposition |
| :--- | :--- | :--- |
| **Encrypted Surveys** | WebCrypto RSA-OAEP + AES-256-GCM | Survey responses cannot be read by Blindsight, cloud hosts, or attackers. |
| **AI Survey Builder** | Llama 3.3 / Mistral / DeepSeek via privacy-gated prompts | Generates complete structured surveys with branching logic and zero PII leakage. |
| **Whistleblower Chat** | Ephemeral token-based proxy routing (`/api/v1/anonymous_chat`) | Compliance officers follow up with reporters without ever discovering identity. |
| **HIPAA/PII DLP** | Regex streaming classifier + ReDoS-hardened bounds | Prevents respondents from accidentally submitting SSNs, MRNs, credit cards, or medical data. |
| **Live Polls** | Server-Sent Events (SSE) via `/api/v1/polls/{id}/stream` | Real-time audience voting for conferences and town halls with sub-second latency. |
| **Modern Mail Client** | Encrypted dispatch, NLP task extraction, ICS calendar parser | Clean inbox triage without leaking sensitive communications to third-party tools. |
| **Productivity Companion** | Unified sidebar (`CompanionSidebar.tsx`) with Calendar & Tasks | Seamless execution loop from survey insights and email triage into action items. |

---

## 5. Pricing Tiers & Unit Economics

| Tier | Price | Survey Limits | Key Features |
| :--- | :--- | :--- | :--- |
| **Free** | $0/mo | 3 surveys, 100 responses/survey | Core survey creation, standard templates, export to CSV/JSON. |
| **Starter** | $19/mo ($190/yr) | 20 surveys, 1,000 responses/survey | Client-side E2EE, AI survey generator, custom branding, email notifications. |
| **Pro** | $49/mo ($490/yr) | 100 surveys, 10,000 responses/mo | Full DLP streaming engine, HMAC audit logs, Webhooks, REST API access. |
| **Enterprise** | Custom Quote ($1,499+/mo) | Unlimited surveys & responses | Dedicated MSA, SAML 2.0 SSO, SCIM 2.0, Whistleblower Suite, custom SLA. |

---

## 6. Competitive Comparison Matrix

| Feature | Blindsight | Qualtrics | SurveyMonkey | Google Forms |
| :--- | :---: | :---: | :---: | :---: |
| **Zero-Knowledge Client-Side E2EE** | **Yes (WebCrypto)** | No | No | No |
| **GDPR Art. 17 Anti-Resurrection Shredding** | **Yes (Key-per-Subject)** | No (Soft Delete) | No (Soft Delete) | No |
| **HIPAA 18-ePHI Automatic Redaction** | **Yes (Built-in DLP)** | Add-on ($$$$) | No | No |
| **Anonymous Two-Way Whistleblower Chat** | **Yes (Proxy Token)** | No | No | No |
| **HMAC Chained Audit Trail** | **Yes (Mathematical)** | Proprietary log | Basic log | Basic log |
| **Open REST & SCIM 2.0 API** | **Yes (Standard)** | Enterprise only | Enterprise only | Workspace API |
| **Transparent Pricing** | **Yes ($0 - $49/mo)** | Opaque ($5,000+) | Opaque | Free / Workspace |

---

## 7. Developer & API Integration

- **Public SP SAML Metadata**: `GET https://blindsightsurveys.com/api/v1/auth/sso/metadata`
- **SAML ACS Endpoint**: `POST https://blindsightsurveys.com/api/v1/auth/sso/acs`
- **SCIM 2.0 Service Provider Config**: `GET https://blindsightsurveys.com/api/v1/scim/v2/ServiceProviderConfig`
- **SCIM 2.0 Users Endpoint**: `GET|POST https://blindsightsurveys.com/api/v1/scim/v2/Users`
- **Public Open-Source / Partner Ingestion**: Developer marketplace and OAuth2 applications (`https://blindsightsurveys.com/api/v1/partner/apps`).