Security

Zellio.io processes your data on your device. That is an architecture, not a policy promise — the tools have no upload endpoint to send your files to, so keeping your data local is not something we have to remember to do correctly on a server. This page explains how that works, what protects the site itself, and where the limits of the model are.

The no-upload architecture

Every tool runs inside your browser tab using standard web APIs: the File API reads files from your disk without transmitting them, Canvas processes images, Web Crypto performs hashing and encryption with the same primitives native software uses, and WebAssembly runs the heavier engines — the SQL playground's database engine among them — at close to native speed. Files are read directly where they sit; even multi-hundred-megabyte data files are read in byte ranges on demand rather than loaded anywhere.

You can verify this yourself in about a minute, and we encourage it: open your browser's developer tools, watch the Network tab while using any tool, and confirm that no request carries your file. Or load a tool page, disconnect from the internet entirely, and use it — the tools keep working, because there was never a server involved in the processing.

Content Security Policy

The application ships a restrictive Content Security Policy: scripts may only load from this origin, the tools' network access is limited to this origin plus the one external service the IP tester needs, and fonts are self-hosted. There are no CDN-hosted script includes. Third-party machine-learning models used by tools — such as the face-detection weights in the image redactor — are committed to the codebase and served from our own origin, so using those features never contacts the model's original publisher.

Dependencies

Third-party code is where most web security incidents start, so the dependency tree is audited against known-vulnerability databases as a hard release gate: a build with a high or critical finding does not ship. Dependencies are pinned and upgraded deliberately rather than automatically.

What this model does not protect against

Honesty about limits is part of security. Client-side processing removes one specific risk — your files being copied to infrastructure you cannot see. It does not protect a device that is already compromised. Browser extensions with broad permissions can read what any page displays, including this one. And the page you load is still code we serve, so you are trusting this site each time you load it — the difference from an upload service is that you are not also trusting its storage, its retention policy, and every future breach of them.

Two tools deserve a specific caveat. The text encryptor is only as strong as the password you choose, and there is deliberately no recovery path. And in the image redactor, only the black-box style is irreversible — pixelate and blur leave recoverable information, which the tool itself tells you.

Reporting a vulnerability

If you believe you have found a security issue, email hello@zellio.io with "Security" in the subject line. Describe what you found and how to reproduce it. We read every report, act on genuine issues promptly, and will credit you in the changelog if you want the credit. Please do not test against other users' data — though the architecture means there is none on our servers to test against.