Parse The Data
Local only

Security

A small network surface and an explicit browser boundary.

Reference

Controls that support the local-processing claim

The security design reduces ways dataset contents could leave the tab. These controls are defense in depth, not a claim that any browser application is invulnerable.

Browser controls

  • Dataset parsing runs in a dedicated Web Worker.
  • Dataset and reference routes keep connect-src 'none', blocking fetch, XMLHttpRequest, WebSocket, and similar application connections.
  • Only Natural Voice uses connect-src 'self', and its browser code calls one same-origin rewrite path.
  • Scripts, styles, fonts, and workers are restricted to the same origin; Trusted Types further protects script-loading sinks.
  • Forms, embedded frames, plugins, cameras, microphones, location, payments, and USB access are disabled by policy.

Server controls

  • GET and HEAD serve the site; one exact path accepts POST for Natural Voice, while other methods and paths return 405.
  • The rewrite route requires a same-origin browser request and an exact JSON media type, streams and bounds the body before parsing, rejects unsupported fields, and applies a per-client limit to every model invocation.
  • Initial inference fails closed when rate limiting is unavailable. Exact details use randomized locked placeholders; responses that drop, duplicate, reorder, or fabricate those locked tokens are rejected.
  • The canonical www hostname redirects permanently to the apex domain.
  • HSTS, frame denial, MIME sniffing protection, a strict referrer policy, cross-origin isolation headers, no-store API responses, and versioned assets are applied to responses.

Operational limits

The application currently limits local files to 10 MB. It does not provide accounts, shared storage, access controls, audit trails, encryption-key management, certifications, or a formal service-level agreement.

Report a vulnerability

Please avoid including real sensitive data in a report. Email security@parsethedata.com with reproducible steps and the affected route or release.

Has Parse The Data been independently audited?

No independent security audit or compliance certification is currently claimed. The public controls and source code are available for review.

Can the application make network requests after loading?

Dataset and reference routes set connect-src to none. Natural Voice alone allows same-origin connections so it can call the site’s bounded rewrite endpoint; third-party browser connections remain blocked.