Working With Client Data Under an NDA
Your client sends an extract. The agreement you signed says it does not go to third-party services. And the tool you would normally reach for is a third-party service. This is the practical way round that, and what to say when the client asks.
The Clause You Are About to Breach
Most confidentiality agreements contain some version of three restrictions. An online CSV viewer, a spreadsheet-to-SQL web app, or a text-to-SQL assistant will run into all three at once:
| Typical clause | What an online tool does |
|---|---|
| Do not disclose to any third party | The upload is the disclosure. The operator now holds the data, whatever their policy says. |
| No sub-processors without written consent | The tool's own hosting, storage and logging providers all become sub-processors you did not name. |
| Data stays within a named jurisdiction | You usually cannot tell which region a free web tool processes in, and the answer may change without notice. |
| Return or destroy on request | You cannot honour this for a copy sitting in someone else's logs or backups. |
Nothing here requires bad faith on anyone's part. A perfectly reputable service still puts you in breach, because the breach happens at upload, not at misuse.
patient_nhs_number tells a reader a great deal before a single value goes with it.A Workflow You Can Defend
- Open the app. That page load is the only network activity in the session.
- Add the client extract. It is read in the tab; no request is made.
- Query it. In SQL, or in plain English — the English box is a parser on this page, not a service call.
- Export the summary you need for the deliverable.
- Close the tab. The data is gone. Nothing was stored, because there is nowhere for it to be stored.
Worked example, on a 150-row ledger loaded as C. total amount by client:
SELECT client, SUM(amount) AS total_amount FROM C GROUP BY client
total hours by category, for the work-in-progress report:
SELECT category, SUM(hours) AS total_hours FROM C GROUP BY category
And by matter, for the client file:
SELECT matter, SUM(amount) AS total_amount FROM C GROUP BY matter
Query the extract without it leaving your laptop.
Open the app →Proving It, Rather Than Asserting It
The useful move mid-engagement is to disconnect and carry on. Take the network down after the page has loaded, then add the file and run the queries. Everything still works — which is only possible if the first pass was not sending anything either.
That is a demonstration you can perform in front of a client in under a minute, and it is considerably more persuasive than a vendor's privacy page. The walkthrough is here, and the network-panel and CSP checks are here.
What to Tell the Client
Wording you can lift:
If the client's security team wants more, the two things they will ask for are the content security policy — connect-src 'self' and form-action 'none' are the relevant lines — and a build they can host themselves. Both are available; see the security contact.
Practical Hygiene
- Keep the extract on an encrypted volume. The tool never copies it, so the only copy is the one you were given, where you put it.
- Prefer a minimised extract. Ask the client for the columns you need rather than the whole table — the strongest control is data you never received.
- Close the tab when you stop. Loaded files live in tab memory; that is the whole retention policy.
- Mind your exports. They land in your downloads folder like any other file, and they are now your responsibility.
- Note it in the engagement file. A line recording how the data was handled is worth having if anyone asks in a year.
Reasonable Questions
Is this legal advice?
No. It is a description of how the tool handles data, so that you or your counsel can judge it against the agreement you actually signed. Read your own clauses.
Does using this make me compliant?
It removes one specific risk — disclosure by upload. It does not address how you received the file, where you store it, or who else has access to your machine.
Is there an account or a log of my sessions?
There is no account system at all, so there is nothing tying work to a person, and no session history to subpoena or leak.
Can we run it inside our own network?
Yes. A self-contained build for intranet hosting is available on request, which also removes any dependency on this site continuing to exist.
Does the page load anything from a CDN?
No. The code editor, the file-format modules and every script are served from this site, and the content security policy names no other origin. Every request the page makes is listed in the verification guide. In a self-hosted build they are all served from your own network.