Security & Architecture Overview
🔒 Zero Data Exfiltration by Design
Kemi Studio is built on a local-first architectural model. All chemical structure rendering, stereochemical perception (CIP), vector generation, and file manipulation occur entirely in the user's browser sandbox via WebAssembly and local JavaScript. User molecules, reaction pathways, and scientific documents are never uploaded to, processed by, or cached on our servers.
1. Application Profile for IT & Security Teams
| Application Name | Kemi Studio |
|---|---|
| Web Domain | kemistudio.app |
| Category / Classification | Software & Technology • Chemical Sciences & Education • Productivity |
| Hosting Infrastructure | Cloudflare Pages & Edge Network (Global Anycast CDN) |
| Client Runtime | Standard HTML5 / WebAssembly / Modern Evergreen Browsers |
| Network Ports | Port 443 (HTTPS / TLS 1.3 only) |
2. Notice for Corporate Networks & Microsoft Defender SmartScreen
If your organization's web filtering or Microsoft Defender for Endpoint displays a notice stating:
"This content is blocked by your organization — Hosted by kemistudio.app"This is typically triggered by standard corporate policies that restrict access to Newly Registered Domains (NRDs) or Uncategorized Sites during their initial evaluation window.
Recommended Action for IT Administrators
- Category Confirmation: Kemi Studio is a legitimate chemical drawing and visualization tool used by researchers and students.
-
Safe to Allowlist: To grant authorized users access, add
kemistudio.appas an Allow Indicator in the Microsoft Defender Portal (Settings > Endpoints > Indicators > URLs/Domains) or your corporate proxy (e.g., Zscaler, Palo Alto Networks, Fortinet).
3. Hardened HTTP Security Headers
Every response served from kemistudio.app enforces modern security headers:
- Content-Security-Policy (CSP): Restricts scripts, styles, workers, and network connections strictly to authorized origin domains.
-
Strict-Transport-Security (HSTS):
max-age=31536000; includeSubDomains; preloadforces all traffic over encrypted TLS. - X-Frame-Options: DENY: Prevents clickjacking and unauthorized embedding in foreign iframes.
- X-Content-Type-Options: nosniff: Eliminates MIME-type confusion attacks.
- Permissions-Policy: Disables camera, microphone, geolocation, and payment APIs while strictly scoping clipboard read/write to the application origin for vector graphics exchange.
4. Cryptographic License Verification
Kemi Studio supports dual-mode license verification engineered for enterprise environments:
- Air-Gapped / Offline Cryptography: Standalone licenses use asymmetric Ed25519 digital signatures. The public key is embedded directly into the client runtime, enabling 100% offline verification in high-security, air-gapped lab environments with zero network connectivity.
- Online Key Activation: Validated securely against an encrypted Cloudflare D1 SQL store. The device identity is an anonymous one-way SHA-256 hash generated client-side.
5. Vulnerability Disclosure & Security Contacts
We welcome security researchers and enterprise security teams to report any vulnerabilities or anomalies in our software or infrastructure:
- Security Contact: [email protected]
- RFC 9116 Policy: Available at
/.well-known/security.txt - Support & Inquiries: [email protected]