Auto Secure LoginData destruction you can prove — and a receipt that never over-claims.
ASL Shredder is a platform-wide capability that decides what destruction may honestly be claimed before any destructive action runs, executes it, and issues a signed receipt scoped to exactly the evidence available. It refuses to promise more than the medium can deliver — no "secure wipe" theater on an SSD where overwrite doesn't mean what people think. Native Android, Windows, and macOS clients bring the same discipline to end-user file shredding.
The problem
Most "secure erase" is theater.
On modern SSDs, flash, and copy-on-write filesystems, a multi-pass overwrite does not guarantee the old data is gone — the controller may have written elsewhere. Tools that print "securely wiped" anyway are selling a false receipt, and that receipt is exactly what fails in a compliance audit or a courtroom.
Shredder inverts the order: it decides what can be honestly claimed for this specific medium first, then acts, then signs a receipt scoped to only the evidence it actually has.
Anti-snake-oil, enforced
- Denies overwrite-Clear on SSD / flash / virtual / CoW
- Overwrite is never labeled a physical purge on SSD/APFS
- Denies Crypto Erase without a unique destroyable key
- Denies a wipe without device-owner authority
- Legal hold → hard deny; active retention → deny unless override
Capabilities
Grade the claim. Then act. Then sign.
Five graded modes
Delete, Clear, Crypto Erase, Managed Wipe, and Physical Attestation — graded logical / clear / purge / destroy / unverified.
Fail-closed policy
Only proven magnetic media with read-back qualifies for overwrite-Clear; everything else is denied rather than falsely claimed.
Governance gates
A legal hold is a hard deny; active retention is denied unless explicitly overridden — destruction can't quietly violate policy.
Signed canonical receipts
Ed25519-signed receipts with SHA-256 identity digests — a portable, verifiable record of exactly what was done.
Two-step confirmation
An expiring "SHRED <name>" phrase, plus confirmation-time revalidation that aborts if the device state changed since you asked.
Pure-logic policy core
A platform-neutral shred-policy.mjs makes the decisions at both the request and confirm boundaries — testable in isolation.
Native Android
SAF-only file access, FLAG_SECURE, EN/ES, backed by Play entitlement + Integrity attestation on the consumer path — $9.99 one-time.
Windows & macOS
A .NET WPF Windows app (1/3/7-pass with read-back) and a SwiftUI macOS app — the same honest assurance labels.
Signed-header app auth
A dependency-free Node control plane behind hardened systemd, with signed-header app authentication.
Destroy it. Prove it. Don't oversell it.
Fail-closed destruction anchored to NIST SP 800-88 Rev 2, with a signed receipt scoped to exactly the evidence — never snake oil.