Passwords
Secure hashing through password_hash() (Argon2id when available). No plaintext passwords in the database.
Process locally when possible. Keep account data separate from documents.
Privacy is not a marketing badge: it guides the architecture of tools, Studios and synced features.
PRIVACY BY DESIGN
A sensitive file should not be sent somewhere without a reason.
WorkToolset separates account data from processed documents. Local tools use browser APIs and do not send your files to the server. Basic OCR runs in the browser; if a future AI tool requires remote processing, the interface will state it explicitly before any upload. First-party audience measurement records only navigation data useful for product operations (page views, sessions, tool usage, referring domain or UTM campaign, device type, browser family and operating system). No document content or filename, raw IP address, raw user agent or full referrer URL is recorded. A random first-party audience identifier distinguishes returning visitors and is not used for advertising.
See security principles →Your browserPDF • CSV • text • files
local tools
WorkToolset serveraccount • favorites • presets
No document storage by default
SECURITY
The foundations are separate from the marketing layer.
Sessions
Random server-side tokens, HttpOnly cookie and rotation on sign-in.
CSRF & XSS
CSRF token for writes, restrictive CSP and no authentication secrets in localStorage.
Files
No server upload for local tools. Any future uploads will be isolated and limited.