We cannot see your board data.
Not as a policy commitment — as a property of how the application is built. There is no server that receives your files, and the page that reads them is not permitted to open a network connection.
Where things run
| Data | Where it is processed | Where it is stored |
|---|---|---|
| Board images, placement files | In your browser | Your machine only |
| Failure exports, repair notes, serial numbers | In your browser | Your machine only |
| Generated charts and exports | In your browser | Wherever you save them |
| Boards and calibration you choose to keep | In your browser | A file you download, or this browser's own storage on your machine — never ours |
| Failure records entered at the bench | In your browser | This browser's own storage on the machine they were entered on, or a data bundle file you export — never ours, and never synced |
The application is a static bundle. It is delivered over HTTPS from a CDN and then runs offline — you can disconnect the machine after the page loads and every feature still works, including generating and exporting reports.
The policy we serve
Every response for the application carries this Content-Security-Policy.
The directive that matters is connect-src 'none': it instructs the browser
to refuse any network request the page attempts, so the guarantee does not depend on
us having written the code correctly.
default-src 'self';
script-src 'self';
style-src 'self' 'unsafe-inline';
img-src 'self' blob: data:;
font-src 'self';
connect-src 'none';
worker-src 'none';
child-src 'none';
frame-src 'none';
manifest-src 'self';
object-src 'none';
base-uri 'none';
form-action 'none';
frame-ancestors 'none'
Served alongside it: Strict-Transport-Security,
X-Content-Type-Options: nosniff, X-Frame-Options: DENY,
Referrer-Policy: no-referrer, Cross-Origin-Opener-Policy,
Cross-Origin-Resource-Policy, Cross-Origin-Embedder-Policy,
and a Permissions-Policy that disables camera, microphone, geolocation
and USB.
The source of the application itself — everything served under /app/ —
contains no fetch, XMLHttpRequest, WebSocket
or sendBeacon, and no reference to any external origin. A check in our
build pipeline fails if one is introduced, and a second fails if the application so
much as imports the separate page that handles licensing — the one part of the site
allowed to talk to our own server.
How it is verified
Claims like this are easy to make and easy to quietly break. After every production deployment, an automated suite drives the complete flow — load a board package, load failure exports, generate the chart, drill in, export it — through Chromium, Firefox and WebKit, against this site as you would load it, not a local build. A second suite runs on every change before it ships. A run fails if:
- any network request is made to any origin other than the site's own assets;
- the browser reports a single content security policy violation;
- any of the security headers above is missing or weakened;
- or the exported report turns out to reference anything external.
The exported HTML report is opened from disk with the network blocked entirely, to confirm it really is self-contained.
Confirm it yourself
- Open the app and press
F12(or ⌥⌘I) to open developer tools. - Go to the Network tab and clear it.
- Load your files and generate a chart.
- You will see no requests. Not "no uploads" — no requests at all.
You do not need to trust the description above; the check takes a minute.
What Eng Sec Solutions holds
Today, using the tool creates no account and sends us nothing. There is no analytics, no telemetry, no error reporting and no cookies set by the application.
When accounts and billing are available, they will run on separate pages from the
tool, and will hold only what a subscription requires — your name, work email,
organisation and billing details handled by our payment processor. The tool itself
keeps its connect-src 'none' policy: entitlement reaches it as a signed
token it verifies offline, so adding accounts does not add a path for your
board data to reach us.
Reporting a vulnerability
If you find a security issue, please tell us at info@engsecsolutions.com (put SECURITY in the subject line). We aim to reply within one business day and will acknowledge within two at the latest, and keep you updated until it is resolved. Please give us a reasonable opportunity to fix an issue before disclosing it publicly; we will not pursue legal action against good-faith research that respects customer data and avoids service disruption.
Where we are honest about the gaps
Eng Sec Solutions is a small company and we would rather tell you this than let you discover it in a questionnaire: we do not hold SOC 2, ISO 27001 or any comparable certification today, and we have not commissioned an external penetration test. What we offer instead is an architecture with a much smaller thing to certify — the application has no server-side component that touches your data, and the property that matters is one you can verify yourself in a browser in under a minute.
If your procurement process needs a security questionnaire, a data processing agreement, or evidence for a specific control, write to info@engsecsolutions.com and we will work through it with you.