How to Verify Nothing Is Uploaded
If you have to sign off on a tool that touches company data, a privacy policy is not evidence. This guide is for the person who wants to check. Three independent tests, none of which require you to take anyone's word for anything.
Check One: The Network Panel
The browser records every request a page makes. If a file were being uploaded, it would be here.
- Open the app.
- Press
F12(orCtrl+Shift+I) and choose the Network tab. - Press the clear button so the list is empty. Then start work.
- Add a file. Run a query. Type a question in the plain-English box. Export the result.
The list stays empty. Not "only small requests", not "only telemetry" — empty. Adding a 50 MB Parquet file produces no request at all, because the file is read with the browser's own file reader, not sent anywhere.
/cdn-cgi/… — that is Cloudflare, the host, running its bot check as the page is served.Check Two: The Content Security Policy
Check one shows nothing happened this time. A content security policy is a stronger statement: it tells the browser what the page is permitted to do, and the browser enforces it regardless of what any script tries.
Look at the response headers for the page — in the Network panel, click the document request and read Response Headers. Two directives matter:
| Directive | What it means |
|---|---|
connect-src 'self' | Script on this page may only make requests back to this same origin. It cannot post your data to any third-party server, because the browser will refuse to send it. |
form-action 'none' | No form on the page may submit anywhere at all. |
object-src 'none' | No plugins or embedded objects. |
base-uri 'self' | The page's base URL cannot be rewritten to redirect relative requests elsewhere. |
Together those close the network paths off the page. Even a compromised script could not exfiltrate a file to an outside host without the browser blocking it.
Check Three: Disconnect
The simplest test and the hardest to argue with. Load the page, then turn off Wi-Fi or unplug the cable, and keep working: add files, run queries, export results. It all still works, which is only possible if the work was never leaving the machine.
Open the network panel and try it yourself.
Open the tool →The Third-Party Requests, Named
Being first to name your own exceptions is the only way this kind of claim is worth anything. The complete list, for the whole site:
| Request | When | What it carries |
|---|---|---|
cdn.jsdelivr.net | Page load only, and only for the editor | The Monaco code editor — the SQL box itself. A public CDN copy of an open-source editor. It carries no data of yours because it happens before you have added anything. |
/cdn-cgi/… | Page load | Cloudflare's bot check, run by the host as it serves the page. |
That is the entire list. There is no analytics script, no error reporting service, no session recording, no advertising tag and no account system.
What a Security Review Will Ask
| Question | Answer |
|---|---|
| Where is data processed? | In the browser tab, on the reviewer's own machine. |
| Where is data stored? | Nowhere. Files live in tab memory and are gone when the tab closes. Nothing is written to disk except exports you ask for. |
| Is there a data processor to name? | No third party processes the data, because no third party receives it. |
| What is retained, and for how long? | Nothing is retained. There is no account, so there is nothing to tie work to a person. |
| Can it run inside our network? | A self-contained build for intranet hosting is available on request. |
Reasonable Questions
Could a future version start uploading?
A future version could change, as with any hosted software — which is exactly why the three checks above are worth repeating rather than doing once. For an environment where that risk is unacceptable, host a fixed build yourself and the question disappears.
Does the plain-English box call an API?
No, and this surprises people the most. Text-to-SQL normally means sending your schema to a language model. Here it is a parser that ships with the page. Type a question with the network panel open and watch the request count not move — see the guide.
What about local storage?
Small interface preferences only. File contents are never written to local storage, session storage or IndexedDB. Check the Application tab if you want to confirm it.
Is the code auditable?
The shipped JavaScript is minified, as production JavaScript usually is. The behaviour, though, is observable in full: the network panel and the content security policy are not claims, they are enforcement. Source access for review is available under a written licence — ask.