We cannot see your board data.
Not as a policy commitment — as a property of how the application is built. There is no server that receives your files, and the page that reads them is not permitted to open a network connection.
Where things run
| Data | Where it is processed | Where it is stored |
|---|---|---|
| Board images, placement files | In your browser | Your machine only |
| Failure exports, repair notes, serial numbers | In your browser | Your machine only |
| Generated charts and exports | In your browser | Wherever you save them |
| Board package / calibration you choose to save | In your browser | A file you download, or your browser's local storage |
The application is a static bundle. It is delivered over HTTPS from a CDN and then runs offline — you can disconnect the machine after the page loads and every feature still works, including generating and exporting reports.
The policy we serve
Every response for the application carries this Content-Security-Policy.
The directive that matters is connect-src 'none': it instructs the browser
to refuse any network request the page attempts, so the guarantee does not depend on
us having written the code correctly.
default-src 'self';
script-src 'self';
style-src 'self' 'unsafe-inline';
img-src 'self' blob: data:;
font-src 'self';
connect-src 'none';
worker-src 'none';
child-src 'none';
frame-src 'none';
manifest-src 'self';
object-src 'none';
base-uri 'none';
form-action 'none';
frame-ancestors 'none'
Served alongside it: Strict-Transport-Security,
X-Content-Type-Options: nosniff, X-Frame-Options: DENY,
Referrer-Policy: no-referrer, Cross-Origin-Opener-Policy,
Cross-Origin-Resource-Policy, Cross-Origin-Embedder-Policy,
and a Permissions-Policy that disables camera, microphone, geolocation
and USB.
The application source contains no fetch, XMLHttpRequest,
WebSocket, sendBeacon or reference to any external origin.
A check in our build pipeline fails if one is ever introduced.
How it is verified
Claims like this are easy to make and easy to quietly break. On every deployment, an automated suite drives the complete flow — load a board package, load failure exports, generate the chart, drill in, export it — through Chromium, Firefox and WebKit, against the live site rather than a local build. The run fails if:
- any network request is made to any origin other than the site's own assets;
- the browser reports a single content security policy violation;
- any of the security headers above is missing or weakened;
- or the exported report turns out to reference anything external.
The exported HTML report is opened from disk with the network blocked entirely, to confirm it really is self-contained.
Confirm it yourself
- Open the app and press
F12(or ⌥⌘I) to open developer tools. - Go to the Network tab and clear it.
- Load your files and generate a chart.
- You will see no requests. Not "no uploads" — no requests at all.
You do not need to trust the description above; the check takes a minute.
What Eng Sec Solutions holds
Today, using the tool creates no account and sends us nothing. There is no analytics, no telemetry, no error reporting and no cookies set by the application.
When accounts and billing are available, they will run on separate pages from the
tool, and will hold only what a subscription requires — your name, work email,
organisation and billing details handled by our payment processor. The tool itself
keeps its connect-src 'none' policy: entitlement reaches it as a signed
token it verifies offline, so adding accounts does not add a path for your
board data to reach us.
Reporting a vulnerability
If you find a security issue, please tell us at security@engsecsolutions.com. We will acknowledge within two business days and keep you updated until it is resolved. Please give us a reasonable opportunity to fix an issue before disclosing it publicly; we will not pursue legal action against good-faith research that respects customer data and avoids service disruption.
Where we are honest about the gaps
Eng Sec Solutions is a small company and we would rather tell you this than let you discover it in a questionnaire: we do not hold SOC 2, ISO 27001 or any comparable certification today, and we have not commissioned an external penetration test. What we offer instead is an architecture with a much smaller thing to certify — the application has no server-side component that touches your data, and the property that matters is one you can verify yourself in a browser in under a minute.
If your procurement process needs a security questionnaire, a data processing agreement, or evidence for a specific control, write to security@engsecsolutions.com and we will work through it with you.