Privacy Center

Technical audit date: October 10, 2026.

ToolVero is designed around local browser processing whenever the task can reasonably be completed on the user's device. Privacy is a core product principle, while this page documents the specific technical checks behind our current claims. This page documents what we checked rather than making a blanket promise that every future feature will always work the same way.

Privacy-first is a design principle

ToolVero treats local browser processing as a product-design goal: when an everyday task can reasonably be completed on the device, the tool is designed to keep the selected file or text in the browser. We do not use the phrase “private” as a substitute for technical explanation.

What our current audit found

We reviewed the source of all 74 public tool pages, their inline tool scripts and the 8 first-party scripts referenced by those pages for common direct upload mechanisms: fetch(), XMLHttpRequest, WebSocket and sendBeacon. No direct call to a ToolVero document-processing upload endpoint was found. This is a static first-party source review; it does not inspect third-party library internals or observe runtime network traffic, and it does not mean the pages make no network requests.

What “browser processing” means

When a tool is marked Private browser processing, the selected file is read by your browser and the operation is performed locally. The output is then created in your browser for you to download. Your file does not need to be sent to a ToolVero file-processing server.

Offline-ready core and browser cache

ToolVero now registers a service worker that caches selected public pages, styles, icons and tool code after the first successful online visit. The offline cache is for public app resources; the service worker does not intentionally cache PDFs, images, text inputs or generated output files selected inside the tools. Scanned-PDF features and tools that depend on uncached third-party resources may still require a connection.

Third-party libraries

Some operations rely on public JavaScript libraries such as qpdf WebAssembly, PDF.js, jsPDF, pdf-lib, jsPDF, Tesseract.js, Mammoth, SheetJS, QRCode.js or other browser libraries. These resources may be downloaded from a CDN when you open a tool. A CDN connection is different from uploading your selected file to a ToolVero processing server. Third-party providers have their own policies, so review them if this distinction matters for your use case.

Security review batch: October 10, 2026

This is a ToolVero-maintained source review of the packaged site, not an independent audit or certification. We inspected all 74 tool pages for direct file-upload calls and reviewed script loading, document-to-HTML handling and configured response headers. The source review found no direct ToolVero file-upload API in tool code. It cannot prove that third-party scripts never transmit information, or that the deployed site behaves identically in every browser.

Finding and fix: Word to PDF inserted HTML returned from a DOCX conversion library into the page. The library warns that its output is not sanitized. The converter now rebuilds a limited set of text, table and embedded image elements without carrying through script elements, event handlers, styles or unsafe URL attributes. Some advanced DOCX formatting or links may therefore be omitted from the PDF. After a user reported an empty PDF, the converter was changed to render at an on-page coordinate and check that text is placed within the PDF page before downloading. We also added an enforced policy for object embedding, base URLs and framing; the broader script policy remains report-only while dependencies and analytics are assessed.

Remaining work: At least 19 file-tool pages include externally hosted library scripts, while analytics and advertising scripts are also present. This package review does not include an independent third-party penetration test, live network capture with sample files, or verification of the headers actually delivered after deployment. To claim an independent security review, ToolVero must commission an outside reviewer, publish their scope and findings, and fix any material issues they identify. Report a security concern.

For the supplied October 18 SSL/TLS test result and its scope, see the SSL Labs evidence in our Trust Center. Transport-security testing is separate from the source review described here.

Important limitations

• Browser processing is not the same as “the page makes no network connections.” The page may load JavaScript libraries, fonts, analytics or advertising services when those services are enabled.
• Browser memory and device performance can limit very large PDFs, images or documents.
• A future ToolVero feature may require server-side processing. If that happens, the processing method should be clearly disclosed on the affected tool.
• Do not paste passwords, private keys, authentication codes or other secrets into a tool unless you understand exactly what it does.

How to read the privacy badge

Our commitment

We will keep the processing description on each tool aligned with its implementation. If a tool changes from local browser processing to server-side processing, the privacy explanation should change with it rather than continuing to use an outdated claim.

For the broader privacy policy, see ToolVero Privacy Policy. To report a suspected issue, contact hello@toolvero.co or toolvero.co@gmail.com.

Written and maintained by Fahad Farid.