AI Threat Detection & Privacy Architecture

At Stormhood, we believe security should never come at the expense of user privacy. We operate on a strict privacy-first, zero-retention model.

1. The Detection Pipeline: Why Heuristics + LLMs?

Traditional antivirus and browser extensions rely almost entirely on static blacklists. The flaw with this approach is simple: scammers register new domains every 12 seconds and discard them after 48 hours. By the time a URL is added to a public blacklist, the damage is already done.

Stormhood employs a dual-engine architecture:

Incoming Content (URL, Text, or Image)
                │
                ▼
  [Stage 1: Ultra-Fast Heuristic Pre-Filter]
  • Domain age & entropy calculation
  • Homograph / Unicode spoofing check
  • Known malicious URL shortener expansion
  • Whitelist bypass (trusted domains)
                │
       Is Verdict Inconclusive?
                │
                ▼
  [Stage 2: Contextual AI Threat Engine]
  • Evaluates deceptive psychological triggers
  • Inspects OCR text from screenshots
  • Analyzes smart contract drainer patterns
  • Generates Safety Score (0–100) & Plain-English Advice

2. Privacy Guarantee: Zero Chat & Browsing Storage

One of the most common concerns regarding cybersecurity tools is whether your personal data is monitored. Here is our unequivocal commitment:

Ephemeral Scanning: Threat analysis is processed in memory. When you paste text, scan a QR code, or forward a message to our Telegram bot, the content is analyzed and immediately discarded.
No Private Message Storage: We never store the contents of your personal conversations, contact lists, or social media chats in our database.
No Browsing History Profiling: Stormhood does not track or build advertising profiles on the websites you visit.
No Data Selling: We are funded exclusively by user subscriptions (Free Tier + Pro). We will never monetize through third-party data brokers or ad networks.

3. Database Security & Row Level Security (RLS)

All user account data is stored in a dedicated secure database:

Row Level Security (RLS) is enforced at the database layer. No user can ever query or access another user's report history, token pairings, or billing details.
Encrypted Edge Communication: All client apps (Extension, Mobile, Telegram Bot Webhooks) communicate with our backend over TLS 1.3 with cryptographically verified JSON Web Tokens (JWTs) and service keys.

4. Handling False Positives

While our AI accuracy rate exceeds 99.2%, social engineering heuristics can occasionally flag unusual URLs or legitimate security research sites.

If a domain or message is incorrectly flagged, please reach out via our Contact Form or email us directly at info@stormhood.xyz.
Domain misclassifications are reviewed by our security team and resolved globally within 24 hours.