SID-HARD-08 — Sensitive Data UI Protection

Property	Value
Owner	platform
Category	technical
CSF Function	protect
Group	System Hardening Controls

Description

Client-side controls preventing sensitive data exposure through user interface channels:

(1) Keyboard cache disabled on sensitive input fields (PINs, credentials, personal data) to prevent predictive text leakage. (2) Clipboard deactivated on PIN code and credential input fields. (3) Screen capture / app-switcher preview blanked when wallet moves to background — no sensitive data visible in task-switcher thumbnails. (4) Shoulder surfing protection — PIN input masked, sensitive data display requires explicit user action. (5) Screen overlay attack protection — detects invisible/fake UI overlays used to capture sensitive input. (6) Third-party keyboard prevention on sensitive input fields. (7) No sensitive data in push notifications.

Browser-based wallet has limited control over some of these (keyboard cache, screen capture) compared to native mobile apps. Progressive enhancement via wallet-companion and iOS wrapper.

Components

• Wallet Frontend
• Wallet iOS Wrapper
• Wallet Companion

Framework Requirements

EUDI Security Requirements: WIN-8.4.1-Sec-03, WIN-8.4.2-Sec-01, WIN-8.4.4-01

FitCEM Wallet Instance: FIT-DS-05, FIT-DS-06, FIT-DS-07, FIT-DS-11, FIT-PI-01

ISO 27001 Annex A: A.8.12