There Is No File Server.
Traditional web tools upload your documents to a server, process them, and promise to delete them later. Toolzum skips the file server entirely for local tools — your files load into browser memory, process locally via WebAssembly, and are downloaded directly. There is nothing to intercept, no file server to breach, no file to delete. (Account, AI, quota, and payment APIs do exist — they handle sessions and marked cloud features, never your file bytes.)
- — Upload your file to a cloud server
- — Process on remote infrastructure
- — Promise to delete after 2 hours
- — 2-hour breach window exists
- — Files loaded into browser memory via File API
- — Process locally via WebAssembly
- — Nothing to delete — no server, no upload
- — Zero breach surface for file data
Zero-Upload Architecture
Your files are loaded directly into browser memory via the File API. They never traverse a network, never reach a server, and never exist anywhere but your device.
No Data to Breach
Competitors advertise 'auto-delete after 2 hours' — but that 2-hour window is a breach risk. If there is no server, there is no server to breach. Your files exist only in your browser session.
No Telemetry on Your Content
We run zero analytics on file contents or filenames — no session replays, no content inspection. We do record anonymous page views, crash reports, and per-tool quota accounting (never file contents) to keep the site working; see our Privacy Policy for the full list.
Works Offline
After the initial page load, Toolzum functions without any internet connection (local-processing tools). No network dependency during file operations.
Architecture
- Heavy engines use WebAssembly (FFmpeg, Tesseract) and run in your browser's sandboxed worker thread; many tools are plain JavaScript
- Zero file bytes transmitted to external servers during local-tool operations
- Static edge delivery via global CDN — no file storage buckets, no file servers
- Server-side APIs handle sessions, AI proxying for marked cloud tools, quota/analytics accounting, and payments — and they never touch file bytes for local tools
Encryption & Data Flow
- Your file → Browser memory (File API) → WASM processing → Browser memory → Download
- Files are never uploaded, cached, logged, or stored on any server
- After download, file data is garbage-collected by the browser — no retention window
- All network communication encrypted with HSTS enforced (see public/_headers)
Infrastructure & Privacy
- Global edge CDN for fast static delivery — no application servers
- Local-processing tools keep your files entirely in your browser — no server round trip
- Client-side compute architecture — inherently auditable and transparent
- Cloud AI tools are clearly marked so you always know when data leaves your device
Enterprise Security Controls
- Content Security Policy (CSP) headers — restricts script, connection, and frame sources by allowlist
- X-Content-Type-Options: nosniff, X-Frame-Options: DENY, HSTS, strict Referrer-Policy
- No advertising scripts; first-party analytics are consent-gated, and Cloudflare Web Analytics is cookieless and always on (see Cookie Policy)
Built for Sensitive Work
Corporate policies forbid uploading financial data, medical records, or sensitive contracts to external servers. Toolzum runs locally in your browser — your files never leave your machine.
Zero-Trust Architecture
Local-processing tools run in your browser via WebAssembly. Your data never touches our servers.
Local by Architecture
Local tools run entirely in your browser, so their input files are never transmitted. Cloud AI tools are clearly marked and send data only when used.
No Cloud Storage
Local files are processed in browser memory and garbage-collected afterwards. The app shell is cached by the service worker; account, quota and analytics data are stored server-side.
Corporate Policy Safe
Local-processing tools make no external API calls and have no upload queue. Cloud AI features are clearly marked and route through our server to the provider.
Confidential by Design
Documents stay in your browser session — they never reach a server. Suited for contracts, financial records, and other sensitive material.
Works Offline
After initial page load, Toolzum functions without internet access (local-processing tools). No network dependency for file operations.
Local-processing tools keep data on your device. No accounts needed for local tools. Error logs and consent-gated analytics are recorded; see the Privacy Policy. Toolzum is designed with privacy as the default.
Toolzum does not provide legal or regulatory compliance certification. Consult your compliance team for your specific requirements.
Need a formal security assessment for your procurement team? Email contact@toolzum.com and we will share our security documentation and architecture overview.
Request Security Package