Security and Compliance

SynTools security notes: fully static, no upload endpoint, CSP restricts egress to same origin, no third-party scripts or trackers, source published for offline audit — with the dependency licence list and procurement FAQ, ready for technical review.

Where data is processed

• The web app has no upload endpoint; files are processed in browser memory by Canvas / WebAssembly / JavaScript
• Processing a file produces no outbound requests — verify in the Network panel

What the Content-Security-Policy blocks

• default-src 'self': only assets from this origin may load
• connect-src 'self': network requests can only go back here, so third-party analytics cannot work
• script-src 'self' 'wasm-unsafe-eval': no inline scripts, no CDN scripts
• frame-ancestors none: the site cannot be framed by any other origin

Auditable by you

• Source is published under AGPL-3.0 — clone, review, build offline
• Dependencies are pinned in pnpm-lock.yaml, so you can generate an SBOM and verify versions and hashes
• Core dependencies are MIT / Apache-2.0 / MPL-2.0 with no viral GPL components

All SynTools utilities compute locally in your browser; files and text are never uploaded.

Download Desktop Community · Pricing and Licensing · Privacy Notice · About SynTools · All tools（153 tools）